@salesforce/templates
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@salesforce/webapp-template-base-react-app-experimental | AI (phantom-deps): Template assets copied via build script, not imported directly. | ai | |
| dependencies | unvetted-dep:@salesforce/webapp-template-base-web-app-experimental | AI (dependencies): Same-org scoped template package matching package's function. | ai | |
| phantom-deps | phantom-dep:@salesforce/webapp-template-base-web-app-experimental | AI (phantom-deps): Template assets copied via build script, not imported directly. | ai | |
| dependencies | unvetted-dep:@salesforce/webapp-template-base-react-app-experimental | AI (dependencies): Same-org scoped template package matching package's function. | ai | |
| phantom-deps | phantom-dep:@sfdc-webapps/base-reference-app | AI (phantom-deps): Template dependency referenced in config/build scripts, not directly imported; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@sfdc-webapps/base-web-app | AI (phantom-deps): Template dependency referenced in config/build scripts, not directly imported; stable pattern for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Template script passes env to child npm process; standard CLI pattern, not exfiltration. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): salesforce-admin is a Salesforce corporate consolidation account; adding it while removing individual developer accounts is consistent with enterprise access management practices for this publisher. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Salesforce enterprise package; minimal npm README and no keywords are typical for this org's packages and not indicative of spam or phishing. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Mass removal of individual developer maintainers in favor of a corporate admin account is consistent with Salesforce's enterprise access consolidation pattern for this publisher. | ai |
Versions (showing 51 of 74)
| Version | Deps | Published |
|---|---|---|
| 66.13.3 | 8 / 41 | |
| 66.13.2 | 8 / 41 | |
| 66.13.1 | 8 / 41 | |
| 66.13.0 | 8 / 41 | |
| 66.12.0 | 8 / 41 | |
| 66.11.1 | 8 / 39 | |
| 66.11.0 | 8 / 39 | |
| 66.10.4 | 8 / 39 | |
| 66.10.3 | 8 / 38 | |
| 66.10.2 | 8 / 38 | |
| 66.10.1 | 8 / 38 | |
| 66.10.0 | 8 / 38 | |
| 66.9.3 | 8 / 38 | |
| 66.9.2 | 8 / 38 | |
| 66.9.1 | 8 / 38 | |
| 66.9.0 | 8 / 38 | |
| 66.8.0 | 8 / 38 | |
| 66.7.13 | 8 / 38 | |
| 66.7.12 | 8 / 38 | |
| 66.7.11 | 8 / 38 | |
| 66.7.10 | 8 / 38 | |
| 66.7.9 | 8 / 38 | |
| 66.7.8 | 8 / 38 | |
| 66.7.7 | 8 / 38 | |
| 66.7.6 | 8 / 38 | |
| 66.7.5 | 8 / 38 | |
| 66.7.4 | 8 / 38 | |
| 66.7.3 | 8 / 38 | |
| 66.7.2 | 8 / 38 | |
| 66.7.1 | 8 / 38 | |
| 66.7.0 | 8 / 38 | |
| 66.6.2 | 8 / 38 | |
| 66.6.1 | 8 / 38 | |
| 66.6.0 | 8 / 38 | |
| 66.5.6 | 8 / 38 | |
| 66.5.5 | 8 / 38 | |
| 66.5.4 | 8 / 38 | |
| 66.5.3 | 8 / 38 | |
| 66.5.2 | 8 / 38 | |
| 66.5.1 | 8 / 38 | |
| 66.5.0 | 8 / 38 | |
| 66.4.2 | 8 / 38 | |
| 66.4.1 | 8 / 38 | |
| 66.4.0 | 8 / 38 | |
| 66.3.3 | 8 / 38 | |
| 66.3.2 | 8 / 38 | |
| 66.3.1 | 8 / 38 | |
| 66.3.0 | 8 / 38 | |
| 66.2.1 | 8 / 38 | |
| 66.2.0 | 8 / 38 | |
| 66.1.1 | 8 / 36 |
v66.13.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.13.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.13.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.11.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.10.4
2 findingsSpreading entire process.env into an object — may capture all secrets 1341 | run('GraphQL schema (introspect)', 'npm', ['run', 'graphql:schema'], { 1342 | cwd: uiBundleDir, > 1343 | env: { ...process.env, SF_TARGET_ORG: targetOrg }, 1344 | }); 1345 | run('GraphQL codegen', 'npm', ['run', 'graphql:codegen'], { cwd: uiBundleDir });
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v66.10.3
2 findingsSpreading entire process.env into an object — may capture all secrets 1144 | run('GraphQL schema (introspect)', 'npm', ['run', 'graphql:schema'], { 1145 | cwd: uiBundleDir, > 1146 | env: { ...process.env, SF_TARGET_ORG: targetOrg }, 1147 | }); 1148 | run('GraphQL codegen', 'npm', ['run', 'graphql:codegen'], { cwd: uiBundleDir });
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.