@salesforce/mcp-provider-lwc-experts
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Used as a linting tool/API within the MCP LWC analysis tooling, not a direct import. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): Bundled ESM package; CLI dep consumed indirectly via rollup bundle. | ai | |
| phantom-deps | phantom-dep:@eslint/eslintrc | AI (phantom-deps): Framework-scoped eslint config package; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@salesforce/telemetry | AI (phantom-deps): Same Salesforce org scope; consumed indirectly in bundled output. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/parser | AI (phantom-deps): Loaded by convention via eslint config, not direct import. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/eslint-plugin | AI (phantom-deps): Loaded by convention via eslint config, not direct import. | ai | |
| phantom-deps | phantom-dep:cors | AI (phantom-deps): Config-driven dependency in bundled tool; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@modelcontextprotocol/sdk | AI (phantom-deps): Config-driven dependency in bundled tool; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Config-driven dependency in bundled tool; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:stylelint | AI (phantom-deps): Config-driven dependency in bundled tool; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:eventsource | AI (phantom-deps): Config-driven dependency in bundled tool; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@types/eventsource | AI (phantom-deps): Framework-scoped type package loaded by convention; stable for this package. | ai | |
| phantom-deps | phantom-dep:zod-to-json-schema | AI (phantom-deps): Config-driven dependency in bundled tool; stable pattern for this package. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 0.7.0 | 10 / 8 | |
| 0.6.6 | 10 / 8 | |
| 0.6.5 | 10 / 8 | |
| 0.6.4 | 10 / 8 | |
| 0.6.3 | 11 / 8 | |
| 0.6.2 | 11 / 8 | |
| 0.6.1 | 16 / 8 | |
| 0.6.0 | 16 / 8 | |
| 0.5.5 | 16 / 8 | |
| 0.5.4 | 16 / 8 | |
| 0.5.3 | 16 / 8 | |
| 0.5.2 | 16 / 8 | |
| 0.5.1 | 16 / 8 | |
| 0.5.0 | 16 / 8 | |
| 0.4.0 | 16 / 8 | |
| 0.3.0 | 8 / 8 | |
| 0.1.1 | 3 / 10 | |
| 0.1.0 | 3 / 10 |
v0.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.