@salesforce/pwa-kit-runtime
The PWAKit Runtime
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP (127.0.0.1) appears only in a test file as a localhost stub — not production code. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Legitimate Salesforce OSS package; README link dump is documentation-style, not phishing. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() used for MRT rule matching with controlled input; stable pattern for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode appears only in test files asserting binary response handling; not a payload risk. | ai | |
| phantom-deps | phantom-dep:@loadable/babel-plugin | AI (phantom-deps): Used in babel config, not directly imported; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:cross-env | AI (phantom-deps): cross-env is used in npm scripts, not imported; phantom-dep false positive for this package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval('require') is a standard bundler escape hatch in SSR server code; not a supply-chain risk. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 3.18.1 | 15 / 11 | |
| 3.18.0 | 15 / 11 | |
| 3.17.1 | 15 / 11 | |
| 3.17.0 | 15 / 11 | |
| 3.16.0 | 13 / 11 | |
| 3.15.0 | 13 / 11 | |
| 3.14.0 | 13 / 11 | |
| 3.13.0 | 13 / 11 | |
| 3.12.0 | 13 / 11 |
v3.18.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.18.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.17.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.16.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.14.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.13.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.