@qvac/rag
15
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
mafintoshprdn
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:bare-fetch | AI (phantom-deps): Used via package.json imports conditional exports for Bare runtime, not a direct import. | ai | |
| phantom-deps | phantom-dep:bare-crypto | AI (phantom-deps): Used via package.json imports conditional exports for Bare runtime, not a direct import. | ai | |
| phantom-deps | phantom-dep:crypto-browserify | AI (phantom-deps): Used via package.json imports conditional exports as a browser/default shim, not a direct import. | ai | |
| phantom-deps | phantom-dep:hyperdht | AI (phantom-deps): hyperdht is a declared runtime dependency; phantom-dep heuristic misfires here. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package @qvac/rag is a RAG library unrelated to the postgres 'pg' package; Levenshtein match is coincidental. | ai |