@powerlines/plugin-env — Greenflagged

A package containing a Powerlines plugin for injecting static .env configuration values to the code so that they're accessible at runtime.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

stormie-botsullivanpj

Keywords

dotenvpowerlinesstorm-softwarepowerlines-plugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase fully explained by inlinedDependencies bundling pattern documented in package.json.	ai	2026/05/29
source-diff	large-new-source-files	AI (source-diff): New files are inlined dependency bundles explicitly declared in package.json inlinedDependencies.	ai	2026/05/29
source-diff	obfuscated-file:dist/load-DPB0maqs.cjs	AI (source-diff): Bundled dotenv and other known deps; readable structure, hashed chunk filename is normal vite output.	ai	2026/05/29
source-diff	obfuscated-file:dist/json5-DEV_07Nb.cjs	AI (source-diff): Bundled confbox/json5 dependency with long unicode regex lines; not obfuscated, just minified.	ai	2026/05/29
source-diff	obfuscated-file:dist/dist-C_a6goTt.cjs	AI (source-diff): Standard rollup/vite bundle chunk with hashed filename; code is readable and references known deps.	ai	2026/05/29
source-diff	obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/confbox/dist/json5.cjs	AI (source-diff): Minified vendored dependency (confbox) bundled into dist/node_modules via pnpm; not malicious obfuscation.	ai	2026/05/27
phantom-deps	phantom-dep:@alloy-js/markdown	AI (phantom-deps): Config-referenced dep in monorepo plugin; stable false positive for this package.	ai	2026/05/27
provenance	publisher-changed	AI (provenance): stormie-bot is the org's established bot account with 2775 approved packages; transition from GH Actions to this account is expected org automation pattern.	ai	2026/05/22
phantom-deps	phantom-dep:@powerlines/core	AI (phantom-deps): Same org scope; likely loaded by convention or peer dependency pattern, stable false positive for this package.	ai	2026/05/22
source-diff	obfuscated-file:dist/types/env.cjs	AI (source-diff): Minified but fully readable build output for a new package export; no obfuscation or malicious patterns.	ai	2026/05/15
source-diff	obfuscated-file:dist/types/env.mjs	AI (source-diff): Same as .cjs counterpart — minified ESM build output, content is benign env variable metadata.	ai	2026/05/15
dependencies	unvetted-dep:@powerlines/alloy	AI (dependencies): @powerlines/alloy is a sibling package in the same org scope, published by the same Storm Software maintainer with 356 approved packages. Internal org dependency, not a third-party unknown.	ai	2026/04/27
source-diff	obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/jiti/dist/jiti.cjs	AI (source-diff): Minified bundle of the legitimate jiti package included via rolldown bundling of pnpm deps. SLSA provenance attestation confirms CI build integrity. No malicious patterns in sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/confbox/dist/_chunks/libs/json5.cjs	AI (source-diff): Minified bundle of json5 parser from confbox package. Long line is a Unicode regex for JSON5 parsing — entirely benign. SLSA provenance confirms build integrity.	ai	2026/04/27
source-diff	obfuscated-file:dist/node_modules/.pnpm/[email protected]/node_modules/node-fetch-native/dist/proxy.cjs	AI (source-diff): Minified bundle of node-fetch-native proxy module using standard Node.js built-ins. No suspicious network calls or exfiltration. SLSA provenance confirms build integrity.	ai	2026/04/27
phantom-deps	phantom-dep:@storm-software/config-tools	AI (phantom-deps): Config tooling from the same org ecosystem; loaded by convention/config, stable false positive.	ai	2026/04/27
phantom-deps	phantom-dep:@stryke/fs	AI (phantom-deps): Part of the @powerlines monorepo ecosystem; phantom deps are expected for plugin packages loaded by convention or config, not direct import.	ai	2026/04/27
phantom-deps	phantom-dep:powerlines	AI (phantom-deps): Core peer dependency of the @powerlines plugin ecosystem; loaded by convention, not direct import.	ai	2026/04/27
phantom-deps	phantom-dep:@babel/core	AI (phantom-deps): Framework-scoped package loaded by convention in Babel plugin ecosystems; stable false positive for this package.	ai	2026/04/27
phantom-deps	phantom-dep:@stryke/env	AI (phantom-deps): Same monorepo org dependency loaded by config/convention; stable false positive for this plugin package.	ai	2026/04/27
phantom-deps	phantom-dep:@stryke/capnp	AI (phantom-deps): Same monorepo org dependency loaded by config/convention; stable false positive for this plugin package.	ai	2026/04/27
phantom-deps	phantom-dep:@stryke/types	AI (phantom-deps): Type-only dependency from same org; not directly imported at runtime but declared for type resolution.	ai	2026/04/27
phantom-deps	phantom-dep:@alloy-js/core	AI (phantom-deps): Framework-scoped package used via config/convention in the alloy-js ecosystem; stable false positive.	ai	2026/04/27
phantom-deps	phantom-dep:@powerlines/alloy	AI (phantom-deps): Same-org package from the @powerlines monorepo; loaded by plugin convention, not direct import.	ai	2026/04/27
phantom-deps	phantom-dep:@stryke/type-checks	AI (phantom-deps): Same monorepo org utility package; loaded by config/convention, stable false positive.	ai	2026/04/27
phantom-deps	phantom-dep:@alloy-js/typescript	AI (phantom-deps): Framework-scoped package used via config/convention in the alloy-js ecosystem; stable false positive.	ai	2026/04/27
phantom-deps	phantom-dep:@stryke/string-format	AI (phantom-deps): Same monorepo org utility package; loaded by config/convention, stable false positive.	ai	2026/04/27
phantom-deps	phantom-dep:@powerlines/plugin-babel	AI (phantom-deps): Same-org plugin package from the @powerlines monorepo; loaded by plugin convention, not direct import.	ai	2026/04/27
phantom-deps	phantom-dep:@babel/types	AI (phantom-deps): Framework-scoped package loaded by convention via @babel/core; stable pattern for Babel plugins.	ai	2026/04/26
phantom-deps	phantom-dep:@powerlines/plugin-plugin	AI (phantom-deps): Same-org scoped package loaded by convention in plugin ecosystem; stable for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@alloy-js/json	AI (phantom-deps): Config-file referenced dependency; legitimate pattern in code generation frameworks.	ai	2026/04/26
phantom-deps	phantom-dep:@stryke/json	AI (phantom-deps): Config-file referenced dependency; legitimate pattern in config-driven tooling.	ai	2026/04/26