@serenityjs/core
This package contains the fundamental structures and behaviors that define SerenityJS. This package is used in the pre-built server executables that is provided at our [server-binaries](https://github.com/SerenityJS/server-binaries) repository. This packa
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): Monorepo with 490 versions; rapid publishes are consistent with automated CI releasing multiple packages together. | ai | |
| phantom-deps | phantom-dep:fflate | AI (phantom-deps): fflate is a declared runtime dep used in config/build context; phantom-dep heuristic fires on config references. | ai | |
| phantom-deps | phantom-dep:fast-jwt | AI (phantom-deps): fast-jwt is a declared runtime dep; phantom-dep heuristic fires on config references. | ai | |
| phantom-deps | phantom-dep:simplex-noise | AI (phantom-deps): simplex-noise is a declared runtime dep; phantom-dep heuristic fires on config references. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped package @serenityjs/core is a Minecraft server framework, not a typo of 'cors'. Levenshtein match is coincidental. | ai | |
| phantom-deps | phantom-dep:@serenityjs/data | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic false positive for monorepo packages. | ai | |
| phantom-deps | phantom-dep:@bedrock-apis/carolina-authentication | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic fires on config references. | ai | |
| phantom-deps | phantom-dep:@napi-rs/canvas | AI (phantom-deps): @napi-rs/canvas is a declared runtime dep; phantom-dep heuristic fires on config references. | ai |
v0.8.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.20
2 findingsPackage name '@serenityjs/core' is 1 edit(s) away from popular package 'cors'.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.