@powerlines/plugin-automd
A Powerlines plugin to maintain a project's markdown files using AutoMD generators.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): 50x size increase explained by bundling jiti (2.3MB), untyped, acorn into dist/node_modules. Legitimate architectural change from runtime dep to self-bundled deps. | ai | |
| source-diff | net-exec-file:dist/node_modules/.pnpm/[email protected]/node_modules/lodash.deburr/index.cjs | AI (source-diff): lodash.deburr is a well-known lodash utility; net-exec flag is a false positive from rolldown bundler wrapping pattern. No actual network calls in lodash.deburr. | ai | |
| source-diff | obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/jiti.cjs | AI (source-diff): jiti's main dist file is minified by design; legitimate package bundled as transitive dep. | ai | |
| source-diff | obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/babel.mjs | AI (source-diff): ESM variant of jiti babel dist; minified by design. Legitimate package. | ai | |
| source-diff | net-exec-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/babel.mjs | AI (source-diff): ESM variant of jiti babel dist; net+exec is inherent to jiti's design as a runtime loader. | ai | |
| source-diff | obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/untyped/dist/loader/babel.mjs | AI (source-diff): ESM variant of untyped babel loader; minified by design. Legitimate package. | ai | |
| source-diff | net-exec-file:dist/node_modules/.pnpm/[email protected]/node_modules/lodash.deburr/index.mjs | AI (source-diff): ESM variant of lodash.deburr; net-exec flag is false positive from rolldown bundler wrapping. | ai | |
| source-diff | obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/jiti.mjs | AI (source-diff): ESM variant of jiti main dist; minified by design. Legitimate package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large file count increase is due to bundling transitive deps (jiti, untyped, acorn, lodash.deburr) into dist/node_modules, replacing removed 'powerlines' runtime dep. Architectural change, not injection. | ai | |
| source-diff | obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/babel.cjs | AI (source-diff): jiti is a legitimate TypeScript/ESM runtime loader; its dist files are minified by design. Bundled into package dist as a transitive dep replacement for removed 'powerlines' runtime dep. | ai | |
| source-diff | net-exec-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/babel.cjs | AI (source-diff): jiti's core purpose is dynamic code loading/execution; net+exec pattern is inherent to its design, not malicious. Legitimate well-known package bundled as transitive dep. | ai | |
| source-diff | obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/untyped/dist/loader/babel.cjs | AI (source-diff): untyped is a legitimate schema generation package from the UnJS ecosystem; minified dist files are expected. Bundled as transitive dep. | ai | |
| phantom-deps | phantom-dep:@stryke/convert | AI (phantom-deps): @stryke/convert is a declared runtime dependency used in config files; phantom-dep false positive for this plugin package pattern. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from stormie-bot to GitHub Actions is a documented CI/CD migration for Storm Software packages; SLSA provenance attestation confirms pipeline integrity. | ai | |
| phantom-deps | phantom-dep:defu | AI (phantom-deps): defu is a declared runtime dependency used in config files; phantom-dep false positive for this plugin package pattern. | ai | |
| phantom-deps | phantom-dep:powerlines | AI (phantom-deps): powerlines is a declared runtime dependency used in config files; phantom-dep false positive for this plugin package pattern. | ai | |
| phantom-deps | phantom-dep:@stryke/path | AI (phantom-deps): @stryke/path is a declared runtime dependency used in config files; phantom-dep false positive for this plugin package pattern. | ai | |
| phantom-deps | phantom-dep:markdown-toc | AI (phantom-deps): markdown-toc is a declared runtime dependency used in config files; phantom-dep false positive for this plugin package pattern. | ai | |
| phantom-deps | phantom-dep:@stryke/types | AI (phantom-deps): @stryke/types is a type-only dependency from Storm Software's own ecosystem; config-file-only references are expected for TypeScript type packages. | ai | |
| phantom-deps | phantom-dep:@stryke/type-checks | AI (phantom-deps): @stryke/type-checks is a type-only dependency from Storm Software's own ecosystem; config-file-only references are expected for TypeScript type packages. | ai |
Versions (showing 51 of 585)
| Version | Deps | Published |
|---|---|---|
| 0.1.624 | 10 / 3 | |
| 0.1.623 | 10 / 3 | |
| 0.1.622 | 10 / 3 | |
| 0.1.621 | 10 / 3 | |
| 0.1.620 | 10 / 3 | |
| 0.1.619 | 10 / 3 | |
| 0.1.618 | 10 / 3 | |
| 0.1.617 | 10 / 3 | |
| 0.1.616 | 10 / 3 | |
| 0.1.615 | 10 / 3 | |
| 0.1.614 | 10 / 3 | |
| 0.1.613 | 10 / 3 | |
| 0.1.612 | 10 / 3 | |
| 0.1.611 | 10 / 3 | |
| 0.1.610 | 10 / 3 | |
| 0.1.608 | 10 / 3 | |
| 0.1.607 | 10 / 3 | |
| 0.1.606 | 10 / 3 | |
| 0.1.605 | 10 / 3 | |
| 0.1.604 | 10 / 3 | |
| 0.1.603 | 10 / 3 | |
| 0.1.602 | 10 / 3 | |
| 0.1.601 | 10 / 3 | |
| 0.1.600 | 10 / 3 | |
| 0.1.599 | 10 / 3 | |
| 0.1.598 | 10 / 3 | |
| 0.1.597 | 10 / 3 | |
| 0.1.596 | 10 / 3 | |
| 0.1.595 | 10 / 3 | |
| 0.1.594 | 10 / 3 | |
| 0.1.593 | 10 / 3 | |
| 0.1.592 | 10 / 3 | |
| 0.1.591 | 10 / 3 | |
| 0.1.590 | 10 / 3 | |
| 0.1.589 | 10 / 3 | |
| 0.1.588 | 10 / 3 | |
| 0.1.587 | 10 / 3 | |
| 0.1.586 | 10 / 3 | |
| 0.1.585 | 10 / 3 | |
| 0.1.584 | 10 / 3 | |
| 0.1.583 | 10 / 3 | |
| 0.1.582 | 10 / 3 | |
| 0.1.581 | 10 / 3 | |
| 0.1.580 | 10 / 3 | |
| 0.1.579 | 10 / 3 | |
| 0.1.578 | 10 / 3 | |
| 0.1.577 | 10 / 3 | |
| 0.1.576 | 10 / 3 | |
| 0.1.575 | 10 / 3 | |
| 0.1.574 | 10 / 3 | |
| 0.1.573 | 10 / 3 |
v0.1.624
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.623
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.622
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.621
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.620
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.619
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.618
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.617
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.616
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.615
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.614
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.613
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.612
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.611
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.610
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.608
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.607
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.606
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.605
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.604
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.603
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.602
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.601
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.