@percepta/create
Scaffold a new Mosaic package
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:handlebars | AI (dependencies): Handlebars is a well-known templating library; expected for a scaffolding/template CLI tool. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 localhost reference in a Playwright test config template; not a malicious raw IP. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Intentional env forwarding to child process in a local dev script template; not a secret-leak risk in this context. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() used in a Proxy handler for auth delegation — standard pattern, not obfuscation. | ai |
Versions (showing 50 of 50)
| Version | Deps | Published |
|---|---|---|
| 5.0.0 | 11 / 16 | |
| 4.4.0 | 11 / 16 | |
| 4.3.5 | 7 / 5 | |
| 4.3.4 | 7 / 5 | |
| 4.3.3 | 7 / 5 | |
| 4.3.1 | 7 / 5 | |
| 4.3.0 | 7 / 5 | |
| 4.2.3 | 7 / 5 | |
| 4.2.2 | 7 / 5 | |
| 4.2.1 | 7 / 5 | |
| 4.2.0 | 7 / 5 | |
| 4.1.16 | 7 / 5 | |
| 4.1.15 | 7 / 5 | |
| 4.1.14 | 7 / 5 | |
| 4.1.13 | 7 / 5 | |
| 4.1.12 | 7 / 5 | |
| 4.1.11 | 7 / 5 | |
| 4.1.10 | 7 / 5 | |
| 4.1.9 | 7 / 5 | |
| 4.1.8 | 7 / 5 | |
| 4.1.7 | 7 / 5 | |
| 4.1.6 | 7 / 5 | |
| 4.1.5 | 7 / 5 | |
| 4.1.4 | 7 / 5 | |
| 4.1.3 | 7 / 5 | |
| 4.1.2 | 7 / 5 | |
| 4.1.1 | 7 / 5 | |
| 4.1.0 | 7 / 5 | |
| 4.0.1 | 7 / 5 | |
| 4.0.0 | 7 / 5 | |
| 3.6.3 | 7 / 5 | |
| 3.6.2 | 7 / 5 | |
| 3.6.1 | 7 / 5 | |
| 3.6.0 | 7 / 5 | |
| 3.5.2 | 7 / 5 | |
| 3.5.1 | 7 / 5 | |
| 3.5.0 | 7 / 5 | |
| 3.4.3 | 7 / 5 | |
| 3.4.2 | 7 / 5 | |
| 3.4.1 | 7 / 5 | |
| 3.4.0 | 7 / 5 | |
| 3.3.0 | 7 / 5 | |
| 3.2.0 | 7 / 5 | |
| 3.1.5 | 7 / 5 | |
| 3.1.4 | 7 / 7 | |
| 3.1.3 | 7 / 7 | |
| 3.1.2 | 7 / 7 | |
| 3.1.0 | 7 / 7 | |
| 3.0.1 | 7 / 7 | |
| 3.0.0 | 7 / 7 |
v5.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.