@powerlines/plugin-graphql
A Powerlines plugin to generate project code from GraphQL schemas.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@power-plant/core | AI (dependencies): First-party monorepo dep from same publisher/org, part of refactor. | ai | |
| phantom-deps | phantom-dep:@power-plant/core | AI (phantom-deps): Likely used via bundled/dist build, heuristic false positive for this monorepo. | ai | |
| dependencies | unvetted-dep:@powerlines/plugin-power-plant | AI (dependencies): Sibling plugin package in same monorepo/ecosystem. | ai | |
| dependencies | unvetted-dep:@power-plant/graphql-codegen | AI (dependencies): First-party monorepo dep from same publisher/org. | ai | |
| dependencies | unvetted-dep:@power-plant/graphql-schema | AI (dependencies): First-party monorepo dep from same publisher/org. | ai | |
| source-diff | obfuscated-file:dist/powerlines/src/plugin-utils/get-config-path.cjs | AI (source-diff): File is minified build output of a config path resolver; logic is transparent (existsSync checks for various config file extensions). Not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/powerlines/src/plugin-utils/get-config-path.mjs | AI (source-diff): ESM variant of the same minified config path resolver. Benign minified build output, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed to GitHub Actions CI with SLSA Sigstore attestation — a legitimate migration to automated publishing, not a compromise indicator for this package. | ai | |
| phantom-deps | phantom-dep:powerlines | AI (phantom-deps): Phantom dependency pattern is legitimate for monorepo plugins; powerlines is used indirectly. | ai | |
| phantom-deps | phantom-dep:jiti | AI (phantom-deps): Phantom dependency pattern is legitimate for config-driven code generation tools; jiti is used indirectly. | ai | |
| phantom-deps | phantom-dep:@stryke/type-checks | AI (phantom-deps): Phantom dependency pattern is legitimate for utility libraries used indirectly. | ai | |
| phantom-deps | phantom-dep:@stryke/types | AI (phantom-deps): Phantom dependency pattern is legitimate for type utilities used indirectly. | ai | |
| phantom-deps | phantom-dep:@stryke/path | AI (phantom-deps): Phantom dependency pattern is legitimate for utility libraries used indirectly in config. | ai | |
| phantom-deps | phantom-dep:@graphql-codegen/cli | AI (phantom-deps): Phantom dependency pattern is legitimate for code generation tools; CLI is used indirectly. | ai | |
| phantom-deps | phantom-dep:defu | AI (phantom-deps): Phantom dependency pattern is legitimate for config-driven code generation tools; defu is used indirectly. | ai |
Versions (showing 51 of 583)
| Version | Deps | Published |
|---|---|---|
| 0.1.607 | 9 / 2 | |
| 0.1.606 | 8 / 3 | |
| 0.1.605 | 8 / 3 | |
| 0.1.604 | 8 / 3 | |
| 0.1.603 | 8 / 3 | |
| 0.1.602 | 8 / 3 | |
| 0.1.601 | 8 / 3 | |
| 0.1.600 | 8 / 3 | |
| 0.1.599 | 8 / 3 | |
| 0.1.598 | 8 / 3 | |
| 0.1.597 | 8 / 3 | |
| 0.1.596 | 8 / 3 | |
| 0.1.595 | 8 / 3 | |
| 0.1.594 | 8 / 3 | |
| 0.1.593 | 8 / 3 | |
| 0.1.592 | 8 / 3 | |
| 0.1.591 | 8 / 3 | |
| 0.1.590 | 8 / 3 | |
| 0.1.589 | 8 / 3 | |
| 0.1.588 | 8 / 3 | |
| 0.1.587 | 8 / 3 | |
| 0.1.586 | 8 / 3 | |
| 0.1.585 | 8 / 3 | |
| 0.1.584 | 8 / 3 | |
| 0.1.583 | 8 / 3 | |
| 0.1.582 | 8 / 3 | |
| 0.1.581 | 8 / 3 | |
| 0.1.580 | 8 / 3 | |
| 0.1.579 | 8 / 3 | |
| 0.1.578 | 8 / 3 | |
| 0.1.577 | 8 / 3 | |
| 0.1.576 | 8 / 3 | |
| 0.1.575 | 8 / 3 | |
| 0.1.574 | 8 / 3 | |
| 0.1.573 | 8 / 3 | |
| 0.1.572 | 8 / 3 | |
| 0.1.571 | 8 / 3 | |
| 0.1.570 | 8 / 3 | |
| 0.1.569 | 8 / 3 | |
| 0.1.568 | 8 / 3 | |
| 0.1.567 | 8 / 3 | |
| 0.1.566 | 8 / 3 | |
| 0.1.565 | 8 / 3 | |
| 0.1.564 | 8 / 3 | |
| 0.1.563 | 8 / 3 | |
| 0.1.562 | 8 / 3 | |
| 0.1.561 | 8 / 3 | |
| 0.1.560 | 8 / 3 | |
| 0.1.559 | 8 / 3 | |
| 0.1.558 | 8 / 3 | |
| 0.1.557 | 8 / 3 |
v0.1.607
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.606
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.605
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.604
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.603
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.602
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.