← Home

@powerlines/plugin-env

npm Repository Homepage

A package containing a Powerlines plugin for injecting static .env configuration values to the code so that they're accessible at runtime.

100
Versions
Apache-2.0
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

stormie-botsullivanpj

Keywords

dotenvpowerlinesstorm-softwarepowerlines-plugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@powerlines/plugin-power-plant AI (dependencies): Same-org sibling package in monorepo release train, not third-party. ai
publish-pattern new-deps-added AI (publish-pattern): Internal rename/split within trusted publisher's ecosystem, not injection of unrelated dep. ai
dependencies unvetted-dep:@power-plant/schema AI (dependencies): Sibling monorepo package replacing @powerlines/schema; same publisher/org pattern. ai
dependencies unvetted-dep:@power-plant/alloy-js AI (dependencies): Fits existing alloy-js plugin family already depended on; no malicious behavior evident. ai
source-diff source-size-tripled AI (source-diff): Size increase fully explained by inlinedDependencies bundling pattern documented in package.json. ai
source-diff large-new-source-files AI (source-diff): New files are inlined dependency bundles explicitly declared in package.json inlinedDependencies. ai
source-diff obfuscated-file:dist/json5-DEV_07Nb.cjs AI (source-diff): Bundled confbox/json5 dependency with long unicode regex lines; not obfuscated, just minified. ai
source-diff obfuscated-file:dist/load-DPB0maqs.cjs AI (source-diff): Bundled dotenv and other known deps; readable structure, hashed chunk filename is normal vite output. ai
source-diff obfuscated-file:dist/dist-C_a6goTt.cjs AI (source-diff): Standard rollup/vite bundle chunk with hashed filename; code is readable and references known deps. ai
source-diff obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/confbox/dist/json5.cjs AI (source-diff): Minified vendored dependency (confbox) bundled into dist/node_modules via pnpm; not malicious obfuscation. ai
phantom-deps phantom-dep:@alloy-js/markdown AI (phantom-deps): Config-referenced dep in monorepo plugin; stable false positive for this package. ai
phantom-deps phantom-dep:@powerlines/core AI (phantom-deps): Same org scope; likely loaded by convention or peer dependency pattern, stable false positive for this package. ai
provenance publisher-changed AI (provenance): stormie-bot is the org's established bot account with 2775 approved packages; transition from GH Actions to this account is expected org automation pattern. ai
source-diff obfuscated-file:dist/types/env.cjs AI (source-diff): Minified but fully readable build output for a new package export; no obfuscation or malicious patterns. ai
source-diff obfuscated-file:dist/types/env.mjs AI (source-diff): Same as .cjs counterpart — minified ESM build output, content is benign env variable metadata. ai
dependencies unvetted-dep:@powerlines/alloy AI (dependencies): @powerlines/alloy is a sibling package in the same org scope, published by the same Storm Software maintainer with 356 approved packages. Internal org dependency, not a third-party unknown. ai
source-diff obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/confbox/dist/_chunks/libs/json5.cjs AI (source-diff): Minified bundle of json5 parser from confbox package. Long line is a Unicode regex for JSON5 parsing — entirely benign. SLSA provenance confirms build integrity. ai
source-diff obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/jiti.cjs AI (source-diff): Minified bundle of the legitimate jiti package included via rolldown bundling of pnpm deps. SLSA provenance attestation confirms CI build integrity. No malicious patterns in sample. ai
source-diff obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/node-fetch-native/dist/proxy.cjs AI (source-diff): Minified bundle of node-fetch-native proxy module using standard Node.js built-ins. No suspicious network calls or exfiltration. SLSA provenance confirms build integrity. ai
phantom-deps phantom-dep:@stryke/fs AI (phantom-deps): Part of the @powerlines monorepo ecosystem; phantom deps are expected for plugin packages loaded by convention or config, not direct import. ai
phantom-deps phantom-dep:@storm-software/config-tools AI (phantom-deps): Config tooling from the same org ecosystem; loaded by convention/config, stable false positive. ai
phantom-deps phantom-dep:@powerlines/plugin-babel AI (phantom-deps): Same-org plugin package from the @powerlines monorepo; loaded by plugin convention, not direct import. ai
phantom-deps phantom-dep:@stryke/string-format AI (phantom-deps): Same monorepo org utility package; loaded by config/convention, stable false positive. ai
phantom-deps phantom-dep:@alloy-js/typescript AI (phantom-deps): Framework-scoped package used via config/convention in the alloy-js ecosystem; stable false positive. ai
phantom-deps phantom-dep:@stryke/type-checks AI (phantom-deps): Same monorepo org utility package; loaded by config/convention, stable false positive. ai
phantom-deps phantom-dep:@powerlines/alloy AI (phantom-deps): Same-org package from the @powerlines monorepo; loaded by plugin convention, not direct import. ai
phantom-deps phantom-dep:@alloy-js/core AI (phantom-deps): Framework-scoped package used via config/convention in the alloy-js ecosystem; stable false positive. ai
phantom-deps phantom-dep:@stryke/types AI (phantom-deps): Type-only dependency from same org; not directly imported at runtime but declared for type resolution. ai
phantom-deps phantom-dep:@stryke/capnp AI (phantom-deps): Same monorepo org dependency loaded by config/convention; stable false positive for this plugin package. ai
phantom-deps phantom-dep:@stryke/env AI (phantom-deps): Same monorepo org dependency loaded by config/convention; stable false positive for this plugin package. ai
phantom-deps phantom-dep:@babel/core AI (phantom-deps): Framework-scoped package loaded by convention in Babel plugin ecosystems; stable false positive for this package. ai
phantom-deps phantom-dep:powerlines AI (phantom-deps): Core peer dependency of the @powerlines plugin ecosystem; loaded by convention, not direct import. ai
phantom-deps phantom-dep:@babel/types AI (phantom-deps): Framework-scoped package loaded by convention via @babel/core; stable pattern for Babel plugins. ai
phantom-deps phantom-dep:@powerlines/plugin-plugin AI (phantom-deps): Same-org scoped package loaded by convention in plugin ecosystem; stable for this package. ai
phantom-deps phantom-dep:@alloy-js/json AI (phantom-deps): Config-file referenced dependency; legitimate pattern in code generation frameworks. ai
phantom-deps phantom-dep:@stryke/json AI (phantom-deps): Config-file referenced dependency; legitimate pattern in config-driven tooling. ai

Versions (showing 100 of 572)

Version Deps Published
0.16.235 27 / 2
0.16.234 29 / 2
0.16.233 29 / 2
0.16.232 29 / 2
0.16.231 29 / 2
0.16.230 29 / 2
0.16.229 29 / 2
0.16.227 29 / 2
0.16.226 29 / 2
0.16.225 29 / 2
0.16.224 29 / 2
0.16.223 29 / 2
0.16.221 29 / 2
0.16.220 29 / 2
0.16.219 29 / 2
0.16.218 29 / 2
0.16.217 29 / 2
0.16.216 29 / 2
0.16.215 29 / 2
0.16.214 29 / 2
0.16.213 29 / 2
0.16.212 29 / 2
0.16.211 29 / 2
0.16.210 29 / 2
0.16.208 29 / 2
0.16.207 29 / 2
0.16.206 29 / 2
0.16.205 29 / 2
0.16.204 29 / 2
0.16.203 29 / 2
0.16.202 29 / 2
0.16.201 29 / 2
0.16.200 28 / 2
0.16.199 28 / 2
0.16.198 28 / 2
0.16.197 28 / 2
0.16.196 28 / 2
0.16.195 28 / 2
0.16.192 27 / 2
0.16.191 27 / 2
0.16.190 27 / 2
0.16.189 27 / 2
0.16.188 27 / 2
0.16.187 27 / 2
0.16.185 27 / 2
0.16.184 27 / 2
0.16.183 27 / 2
0.16.182 27 / 2
0.16.181 27 / 2
0.16.180 27 / 2
0.16.179 27 / 2
0.16.178 27 / 2
0.16.177 27 / 2
0.16.176 27 / 2
0.16.175 27 / 2
0.16.174 27 / 2
0.16.173 27 / 2
0.16.172 27 / 2
0.16.171 27 / 2
0.16.170 27 / 2
0.16.169 27 / 2
0.16.168 27 / 2
0.16.167 27 / 2
0.16.166 27 / 2
0.16.165 27 / 2
0.16.164 27 / 2
0.16.163 27 / 2
0.16.162 27 / 2
0.16.161 27 / 2
0.16.160 27 / 2
0.16.157 27 / 2
0.16.156 27 / 2
0.16.155 27 / 2
0.16.154 27 / 2
0.16.153 27 / 2
0.16.152 27 / 2
0.16.151 27 / 2
0.16.150 27 / 2
0.16.149 27 / 2
0.16.148 27 / 2
0.16.147 27 / 2
0.16.146 27 / 2
0.16.145 27 / 2
0.16.144 27 / 2
0.16.143 27 / 2
0.16.142 27 / 2
0.16.141 27 / 2
0.16.140 27 / 2
0.16.139 27 / 2
0.16.138 27 / 2
0.16.137 27 / 2
0.16.136 27 / 2
0.16.135 27 / 2
0.16.134 27 / 2
0.16.133 27 / 2
0.16.131 27 / 2
0.16.130 27 / 2
0.16.129 27 / 2
0.16.128 27 / 2
0.16.127 27 / 2
Showing 100 of 572 Next page →