@prisma/streams-server
Bun-only self-hosted Prisma Streams server.
13
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
prismabotaqrlntylerhogarthankur-datta-007
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Intentional stub package reserving the @prisma/streams-server namespace; empty build and sparse metadata are by design. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes a manifest index secret into a Uint8Array for local DB use; no exfiltration path. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Enumerates env only to warn on unknown DS_* keys; clearly a config validation pattern. | ai | |
| phantom-deps | phantom-dep:proper-lockfile | AI (phantom-deps): Declared dep used indirectly; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:env-paths | AI (phantom-deps): Declared dep used indirectly; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@durable-streams/client | AI (phantom-deps): Declared dep used indirectly; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads vendored hash modules by constructed local file path; not user-controlled input. | ai |