← Home

@powerlines/plugin-react

npm Repository Homepage

A package containing a Powerlines plugin for building a React application.

51
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

stormie-botsullivanpj

Keywords

reactpowerlinesstorm-softwarepowerlines-plugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@power-plant/schema AI (dependencies): Sibling org package in same monorepo family, low risk. ai
publish-pattern new-deps-added AI (publish-pattern): Single new dep addition, consistent with prolific legitimate publish cadence. ai
dependencies unvetted-dep:@power-plant/alloy-js AI (dependencies): Low-version companion pkg to existing @alloy-js/* deps; no malicious behavior evidenced. ai
phantom-deps phantom-dep:@storm-software/config-tools AI (phantom-deps): Config-only reference, consistent with the storm-software monorepo tooling pattern seen across this package family. ai
provenance publisher-changed AI (provenance): stormie-bot is the established bot publisher for storm-software org with 2775 approved packages; transition from GH Actions is expected CI automation change. ai
source-diff obfuscated-file:dist/index.cjs AI (source-diff): Standard rolldown/rollup minified bundle; readable logic, no malicious patterns. Stable for this package. ai
source-diff obfuscated-file:dist/index.mjs AI (source-diff): Standard rolldown/rollup minified ESM bundle; readable logic, no malicious patterns. Stable for this package. ai
phantom-deps phantom-dep:@powerlines/plugin-env AI (phantom-deps): Same-org dependency; plugin wrapper pattern where deps are configured but not directly imported in analyzed entry points. ai
phantom-deps phantom-dep:@powerlines/alloy AI (phantom-deps): Same-org dependency from Storm Software's @powerlines/* ecosystem; consistent pattern across all plugin packages in this monorepo. ai
phantom-deps phantom-dep:@powerlines/plugin-babel AI (phantom-deps): Same-org dependency; plugin wrapper pattern where deps are configured but not directly imported in analyzed entry points. ai
phantom-deps phantom-dep:@vitejs/plugin-react AI (phantom-deps): This package wraps @vitejs/plugin-react; it's expected to reference it in config files without direct imports in all entry points. ai
phantom-deps phantom-dep:defu AI (phantom-deps): Utility used in config composition; referenced in config files rather than direct imports — stable pattern for this build plugin package. ai
phantom-deps phantom-dep:powerlines AI (phantom-deps): Core powerlines package used in config context; same phantom-dep pattern consistent across this monorepo's plugin packages. ai
dependencies unvetted-dep:@powerlines/alloy AI (dependencies): Same-org @powerlines dependency from publisher with 351 approved packages and SLSA provenance. Consistent with the broader @powerlines ecosystem used throughout this package. ai
phantom-deps phantom-dep:@powerlines/plugin-plugin AI (phantom-deps): Same-org @powerlines dependency declared for runtime plugin loading by the powerlines framework, not direct import. Consistent with plugin architecture pattern across this package family. ai
phantom-deps phantom-dep:@stryke/fs AI (phantom-deps): Referenced in config files rather than direct imports; consistent with plugin/build-tool architecture across all versions. ai
phantom-deps phantom-dep:@powerlines/plugin-vite AI (phantom-deps): Same-org package from Powerlines ecosystem; loaded by convention in plugin architecture, not a security concern. ai
phantom-deps phantom-dep:@alloy-js/markdown AI (phantom-deps): Referenced in config files rather than direct imports; consistent with plugin/build-tool architecture across all versions. ai
phantom-deps phantom-dep:@alloy-js/json AI (phantom-deps): Referenced in config files rather than direct imports; consistent with plugin/build-tool architecture across all versions. ai
phantom-deps phantom-dep:@babel/core AI (phantom-deps): Build plugin package; @babel/core is a framework-scoped dep loaded by convention, not direct import. Stable pattern for this package type. ai
phantom-deps phantom-dep:@stryke/path AI (phantom-deps): Referenced in config files rather than direct imports; consistent with plugin/build-tool architecture across all versions. ai
phantom-deps phantom-dep:@stryke/convert AI (phantom-deps): Referenced in config files rather than direct imports; consistent with plugin/build-tool architecture across all versions. ai
phantom-deps phantom-dep:@stryke/cli AI (phantom-deps): Referenced in config files rather than direct imports; consistent with plugin/build-tool architecture across all versions. ai

Versions (showing 51 of 599)

View all versions
Version Deps Published
0.1.701 24 / 6
0.1.685 23 / 6
0.1.684 22 / 6
0.1.683 21 / 6
0.1.682 21 / 6
0.1.681 21 / 6
0.1.680 21 / 6
0.1.679 21 / 6
0.1.678 20 / 4
0.1.677 20 / 4
0.1.676 20 / 4
0.1.675 20 / 4
0.1.674 20 / 4
0.1.673 20 / 4
0.1.672 20 / 4
0.1.671 20 / 4
0.1.670 20 / 4
0.1.669 20 / 4
0.1.668 20 / 4
0.1.667 20 / 4
0.1.666 20 / 4
0.1.665 20 / 4
0.1.664 20 / 4
0.1.663 20 / 4
0.1.662 20 / 4
0.1.661 20 / 4
0.1.660 20 / 4
0.1.659 20 / 4
0.1.658 20 / 4
0.1.657 20 / 4
0.1.656 20 / 4
0.1.655 20 / 4
0.1.654 20 / 4
0.1.653 20 / 4
0.1.652 20 / 4
0.1.651 20 / 4
0.1.650 20 / 4
0.1.649 20 / 4
0.1.648 20 / 4
0.1.647 20 / 4
0.1.646 20 / 4
0.1.645 20 / 4
0.1.644 20 / 4
0.1.643 20 / 4
0.1.642 20 / 4
0.1.641 20 / 4
0.1.640 20 / 4
0.1.639 20 / 4
0.1.638 20 / 4
0.1.626 20 / 4
0.1.625 20 / 4

v0.1.701

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.685

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.684

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.683

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.682

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.681

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.680

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.679

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.678

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.