@pnpm/fetcher-base
13
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
pnpmuserzkochan
Keywords
pnpmpnpm10fetcher
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@types/ssri | AI (dependencies): @types/ssri is a standard TypeScript type definition for the ssri library; appropriate for a fetcher-base types package and stable across versions. | ai | |
| phantom-deps | phantom-dep:@types/ssri | AI (phantom-deps): @types/* packages are consumed by TypeScript at compile time and are not directly imported; this is expected behavior for type-only dependencies. | ai |