@powerlines/plugin-alloy
A package containing various Alloy framework components and helper utilities.
51
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
stormie-botsullivanpj
Keywords
alloy-jspowerlinespowerlines-plugin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): Size increase attributable to vendored vitest/chai test files. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Explained by same vendored test-tooling leak, not injected payload. | ai | |
| vendored-integrity | unresolved-vendored-tree:dist/node_modules/.pnpm | AI (vendored-integrity): Leaked vitest/chai test deps via pnpm store structure, not an implant; no malicious behavior. | ai | |
| dependencies | unvetted-dep:@power-plant/schema | AI (dependencies): Sibling org package, part of coordinated monorepo refactor. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Explained by dependency restructuring, not stub replacement. | ai | |
| dependencies | unvetted-dep:@power-plant/core | AI (dependencies): Sibling package from same publisher/monorepo, part of refactor. | ai | |
| dependencies | unvetted-dep:@powerlines/plugin-power-plant | AI (dependencies): Sibling package from same publisher/monorepo, part of refactor. | ai | |
| dependencies | unvetted-dep:@power-plant/alloy-js | AI (dependencies): Sibling package from same publisher/monorepo, part of refactor. | ai | |
| provenance | publisher-changed | AI (provenance): stormie-bot is the org's automation account with 2775 approved packages; publisher change from GH Actions is expected CI/CD rotation. | ai | |
| phantom-deps | phantom-dep:@vue/shared | AI (phantom-deps): @vue/shared is a framework-scoped Vue internal loaded by convention; not directly imported but legitimately used as a peer/transitive dep in Vue-ecosystem packages. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is from the same @alloy-js namespace already present in the package; not a suspicious lateral dependency addition. | ai | |
| phantom-deps | phantom-dep:@alloy-js/core | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:defu | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/json | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/path | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/capnp | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/convert | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/helpers | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@alloy-js/markdown | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/type-checks | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@alloy-js/typescript | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@stryke/string-format | AI (phantom-deps): Config-referenced dependency; stable pattern for this build tool package. | ai | |
| phantom-deps | phantom-dep:@babel/preset-typescript | AI (phantom-deps): Framework-scoped Babel preset; loaded by convention, not direct import. | ai | |
| dependencies | unvetted-dep:@alloy-js/rollup-plugin | AI (dependencies): @alloy-js/rollup-plugin is part of the same @alloy-js ecosystem as other vetted deps in this package; consistent with legitimate Alloy framework usage. | ai | |
| phantom-deps | phantom-dep:@powerlines/deepkit | AI (phantom-deps): Same-org monorepo package; phantom dep pattern is expected in this monorepo setup. | ai | |
| phantom-deps | phantom-dep:@alloy-js/rollup-plugin | AI (phantom-deps): Build tool dependency referenced in config files, not directly imported at runtime. Expected pattern for a plugin package in this ecosystem. | ai | |
| phantom-deps | phantom-dep:powerlines | AI (phantom-deps): powerlines is the parent framework package; referenced in config files by convention for this plugin package. Stable false positive for this org's plugin packages. | ai | |
| phantom-deps | phantom-dep:@powerlines/plugin-babel | AI (phantom-deps): Same-org plugin dependency referenced by convention. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@powerlines/plugin-plugin | AI (phantom-deps): Same-org plugin dependency referenced by convention. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-syntax-typescript | AI (phantom-deps): Framework-scoped Babel plugin loaded by convention. Standard pattern for TypeScript-aware plugin packages. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-syntax-jsx | AI (phantom-deps): Framework-scoped Babel plugin loaded by convention, not direct import. Standard pattern for packages integrating with Babel transform pipelines. | ai | |
| phantom-deps | phantom-dep:@stryke/unique-id | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:@stryke/types | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:@stryke/fs | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:unctx | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:@storm-software/config-tools | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:@alloy-js/babel-preset | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai | |
| phantom-deps | phantom-dep:@alloy-js/json | AI (phantom-deps): Build/config dependency; legitimate pattern in TypeScript/monorepo projects. | ai |
Versions (showing 51 of 538)
| Version | Deps | Published |
|---|---|---|
| 0.26.239 | 18 / 3 | |
| 0.26.238 | 18 / 3 | |
| 0.26.237 | 23 / 3 | |
| 0.26.236 | 23 / 3 | |
| 0.26.235 | 23 / 3 | |
| 0.26.234 | 23 / 3 | |
| 0.26.233 | 23 / 3 | |
| 0.26.232 | 23 / 2 | |
| 0.26.231 | 23 / 2 | |
| 0.26.230 | 23 / 2 | |
| 0.26.229 | 23 / 2 | |
| 0.26.228 | 23 / 2 | |
| 0.26.227 | 22 / 2 | |
| 0.26.226 | 22 / 2 | |
| 0.26.225 | 22 / 2 | |
| 0.26.224 | 22 / 2 | |
| 0.26.223 | 22 / 2 | |
| 0.26.222 | 22 / 2 | |
| 0.26.221 | 22 / 2 | |
| 0.26.220 | 22 / 2 | |
| 0.26.219 | 22 / 2 | |
| 0.26.218 | 22 / 2 | |
| 0.26.217 | 22 / 2 | |
| 0.26.216 | 22 / 2 | |
| 0.26.215 | 22 / 2 | |
| 0.26.214 | 22 / 2 | |
| 0.26.213 | 22 / 2 | |
| 0.26.212 | 22 / 2 | |
| 0.26.211 | 22 / 2 | |
| 0.26.210 | 22 / 2 | |
| 0.26.209 | 22 / 2 | |
| 0.26.208 | 22 / 2 | |
| 0.26.207 | 22 / 2 | |
| 0.26.206 | 22 / 2 | |
| 0.26.205 | 22 / 2 | |
| 0.26.204 | 22 / 2 | |
| 0.26.203 | 22 / 2 | |
| 0.26.202 | 22 / 2 | |
| 0.26.201 | 22 / 2 | |
| 0.26.200 | 22 / 2 | |
| 0.26.199 | 22 / 2 | |
| 0.26.198 | 22 / 2 | |
| 0.26.197 | 22 / 2 | |
| 0.26.196 | 22 / 2 | |
| 0.26.195 | 22 / 2 | |
| 0.26.194 | 22 / 2 | |
| 0.26.193 | 22 / 2 | |
| 0.26.192 | 22 / 2 | |
| 0.26.191 | 22 / 2 | |
| 0.26.189 | 22 / 2 | |
| 0.26.187 | 22 / 2 |
v0.26.239
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.238
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.237
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.236
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.235
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.234
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.233
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.191
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.189
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.187
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.