@powerhousedao/switchboard
A powerful document-driven server that provides a unified API for managing and serving document models, drives, and reactors in the Powerhouse ecosystem.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:express | AI (phantom-deps): express is imported dynamically or via re-exports; stable for this package. | ai | |
| phantom-deps | phantom-dep:vite | AI (phantom-deps): vite is used as a runtime dep for the server's build/bundling pipeline; stable for this package. | ai | |
| phantom-deps | phantom-dep:graphql | AI (phantom-deps): graphql is a declared peer/runtime dep used transitively; phantom-dep expected in monorepo. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): pg is a declared runtime dep used in server config; phantom-dep is expected in monorepo setup. | ai | |
| phantom-deps | phantom-dep:cors | AI (phantom-deps): cors is a declared runtime dep used in Express server config; phantom-dep expected in monorepo. | ai | |
| phantom-deps | phantom-dep:body-parser | AI (phantom-deps): body-parser is a declared runtime dep for Express middleware; phantom-dep expected in monorepo. | ai | |
| phantom-deps | phantom-dep:@openfeature/core | AI (phantom-deps): @openfeature/core is a peer dep of @openfeature/server-sdk; phantom-dep expected. | ai | |
| phantom-deps | phantom-dep:exponential-backoff | AI (phantom-deps): Declared runtime dep used in config/retry logic; phantom-dep expected in monorepo setup. | ai | |
| phantom-deps | phantom-dep:@powerhousedao/analytics-engine-knex | AI (phantom-deps): Same-org package in a monorepo context; phantom dep detection is a stable false positive for this package. | ai | |
| dependencies | unvetted-dep:document-drive | AI (dependencies): document-drive is a same-ecosystem Powerhouse package, consistently pinned at matching version in coordinated monorepo releases. Not a supply chain risk. | ai | |
| phantom-deps | phantom-dep:@powerhousedao/analytics-engine-core | AI (phantom-deps): Same-org package in a monorepo context; phantom dep detection is a stable false positive for this package. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 6.0.0 | 39 / 8 | |
| 5.3.6 | 24 / 5 | |
| 5.1.0 | 19 / 4 | |
| 5.0.11 | 19 / 4 | |
| 5.0.9 | 19 / 4 | |
| 5.0.8 | 19 / 4 | |
| 5.0.7 | 19 / 4 | |
| 5.0.6 | 19 / 4 | |
| 5.0.4 | 19 / 4 | |
| 5.0.3 | 19 / 4 | |
| 5.0.2 | 19 / 4 | |
| 5.0.1 | 19 / 4 | |
| 5.0.0 | 19 / 4 |
v6.0.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (memo.dev) than the most recent previously approved version (acaldas.powerhouse) on 2026-05-21, but memo.dev is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.3.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.