@powerlines/plugin-open-feature
A package containing a Powerlines plugin for managing Open Feature feature flags at runtime.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@power-plant/alloy-js | AI (dependencies): New sibling dep within same publisher's toolchain ecosystem, no malicious behavior evidence. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Routine dep addition from trusted monorepo publisher with strong track record. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed from one CI bot (stormie-bot) to another (GitHub Actions). SLSA provenance confirms legitimate build origin from the expected repo. | ai | |
| phantom-deps | phantom-dep:@openfeature/core | AI (phantom-deps): Transitive/config dependency of the OpenFeature plugin; referenced in config files per the finding. | ai | |
| phantom-deps | phantom-dep:@stryke/types | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@alloy-js/json | AI (phantom-deps): Declared dep used indirectly in this plugin framework; phantom detection is a false positive. | ai | |
| phantom-deps | phantom-dep:@stryke/convert | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@alloy-js/markdown | AI (phantom-deps): Declared dep used indirectly in this plugin framework; phantom detection is a false positive. | ai | |
| phantom-deps | phantom-dep:c12 | AI (phantom-deps): c12 is a config-loading utility declared as a dep and referenced in config files; phantom detection is a false positive for this plugin package's architecture. | ai | |
| phantom-deps | phantom-dep:@stryke/string-format | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@powerlines/plugin-plugin | AI (phantom-deps): Same-org sibling package; phantom detection is a false positive for this plugin framework's architecture. | ai | |
| phantom-deps | phantom-dep:@storm-software/config-tools | AI (phantom-deps): Storm Software org config package used indirectly; phantom detection is a false positive for this ecosystem's build pattern. | ai | |
| dependencies | unvetted-dep:@powerlines/plugin-alloy | AI (dependencies): Same-org sibling package from Storm Software / Powerlines ecosystem with established publisher track record and SLSA provenance. | ai | |
| phantom-deps | phantom-dep:@stryke/type-checks | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@stryke/fs | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@stryke/env | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai | |
| phantom-deps | phantom-dep:@stryke/json | AI (phantom-deps): Sibling @stryke/* org package; phantom detection is a false positive for this plugin's indirect usage pattern. | ai |
Versions (showing 51 of 217)
| Version | Deps | Published |
|---|---|---|
| 0.1.244 | 23 / 2 | |
| 0.1.243 | 23 / 2 | |
| 0.1.242 | 22 / 2 | |
| 0.1.241 | 22 / 2 | |
| 0.1.240 | 22 / 2 | |
| 0.1.239 | 22 / 2 | |
| 0.1.238 | 22 / 2 | |
| 0.1.237 | 22 / 3 | |
| 0.1.236 | 22 / 3 | |
| 0.1.235 | 22 / 3 | |
| 0.1.234 | 22 / 3 | |
| 0.1.233 | 22 / 3 | |
| 0.1.232 | 22 / 3 | |
| 0.1.231 | 22 / 3 | |
| 0.1.230 | 22 / 3 | |
| 0.1.229 | 22 / 3 | |
| 0.1.228 | 22 / 3 | |
| 0.1.227 | 22 / 3 | |
| 0.1.226 | 22 / 3 | |
| 0.1.225 | 22 / 3 | |
| 0.1.224 | 22 / 3 | |
| 0.1.223 | 22 / 3 | |
| 0.1.222 | 22 / 3 | |
| 0.1.221 | 22 / 3 | |
| 0.1.220 | 22 / 3 | |
| 0.1.219 | 22 / 3 | |
| 0.1.218 | 22 / 3 | |
| 0.1.217 | 22 / 3 | |
| 0.1.216 | 22 / 3 | |
| 0.1.215 | 22 / 3 | |
| 0.1.214 | 22 / 3 | |
| 0.1.213 | 22 / 3 | |
| 0.1.212 | 22 / 3 | |
| 0.1.211 | 22 / 3 | |
| 0.1.210 | 22 / 3 | |
| 0.1.209 | 22 / 3 | |
| 0.1.208 | 22 / 3 | |
| 0.1.207 | 22 / 3 | |
| 0.1.206 | 22 / 3 | |
| 0.1.205 | 22 / 3 | |
| 0.1.204 | 22 / 3 | |
| 0.1.203 | 22 / 3 | |
| 0.1.202 | 22 / 3 | |
| 0.1.201 | 22 / 3 | |
| 0.1.200 | 22 / 3 | |
| 0.1.199 | 22 / 3 | |
| 0.1.198 | 22 / 3 | |
| 0.1.197 | 22 / 3 | |
| 0.1.185 | 22 / 3 | |
| 0.1.184 | 22 / 3 | |
| 0.1.183 | 22 / 3 |
v0.1.244
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.243
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.242
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.241
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.240
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.239
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.238
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.