← Home

@powerhousedao/shared

npm Repository Homepage

This directory is an npm package which is intended for sharing code across packages in the monorepo.

4
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

acaldas.powerhousememo.devryanwolhuterprometheus-phph-thegoldenmulecallme-tfroidliberuum

Keywords

powerhousevetradocument-modellocal-firstevent-sourcingutilitiestypesshared

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/actions-BqyQ1_K7.d.ts AI (source-diff): Generated .d.ts type declaration bundle, not obfuscated JS; long lines are normal for such files. ai
npm-metadata no-description AI (npm-metadata): Monorepo shared package; description omission not indicative of risk. ai
bogus-package bogus-package AI (bogus-package): Internal shared lib in large monorepo; low-value heuristics are false positives here. ai
source-diff obfuscated-file:dist/types-Bo4Rb8Yf.d.ts AI (source-diff): Type-declaration bundle (.d.ts), not executable obfuscated code; long lines from type generation. ai
publish-pattern new-deps-added AI (publish-pattern): kysely is a well-known, actively maintained SQL query builder. ai

Versions (showing 4 of 4)

Version Deps Published
6.2.1 18 / 11
6.2.0 18 / 11
6.1.0 17 / 11
6.0.0 19 / 8

v6.2.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.2.0

2 findings
HIGH New obfuscated file: dist/types-Bo4Rb8Yf.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.