← Home

@servicetitan/startup

npm Repository Homepage

CLI to create multi-package Lerna projects with TypeScript and React

22
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

st-teamrgdelatojesspkarpoffseanmadidextersealy

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@vitest/coverage-v8 AI (phantom-deps): Framework-scoped, loaded by convention in vitest config; stable false positive. ai
phantom-deps phantom-dep:identity-obj-proxy AI (phantom-deps): Config-file-only reference in a build tooling package; stable false positive. ai
phantom-deps phantom-dep:@jsdevtools/coverage-istanbul-loader AI (phantom-deps): Config-file-only reference; stable false positive for this build tooling package. ai
phantom-deps phantom-dep:jest-environment-jsdom AI (phantom-deps): Referenced in jest config files only; stable false positive for this tooling package. ai
semgrep semgrep:env-spread AI (semgrep): Used in CLI execSync for npm invocation; standard env-forwarding pattern, not exfiltration. ai
phantom-deps phantom-dep:@servicetitan/stylelint-config AI (phantom-deps): Same-org config package; referenced in stylelint config files. ai
phantom-deps phantom-dep:@servicetitan/eslint-config AI (phantom-deps): Same-org config package; referenced in eslint config files. ai
phantom-deps phantom-dep:source-map-loader AI (phantom-deps): Config-file reference in a webpack scaffold; not a direct import. ai
phantom-deps phantom-dep:css-loader AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:swc-loader AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:typescript AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:@types/jest AI (phantom-deps): Framework-scoped types; stable false positive. ai
phantom-deps phantom-dep:less-loader AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:sass-loader AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:@types/debug AI (phantom-deps): Framework-scoped types; stable false positive. ai
phantom-deps phantom-dep:style-loader AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:@svgr/webpack AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:patch-package AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:worker-loader AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:@babel/preset-env AI (phantom-deps): Framework-scoped; stable false positive. ai
phantom-deps phantom-dep:jest-circus AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:jest AI (phantom-deps): Config-only reference in a build tooling package; stable false positive. ai
phantom-deps phantom-dep:lerna AI (phantom-deps): Config-only reference; stable false positive for this monorepo tooling package. ai
phantom-deps phantom-dep:postcss AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:ts-jest AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:prettier AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:@swc/core AI (phantom-deps): Config-only reference; stable false positive. ai
phantom-deps phantom-dep:@jest/core AI (phantom-deps): Framework-scoped; stable false positive. ai
install-scripts install-script:postinstall AI (install-scripts): Postinstall runs a local setup script from the same org's repo; consistent across 351 versions of this build-tool package. ai
semgrep semgrep:dynamic-require AI (semgrep): Requires package.json to read engines field; not loading arbitrary user-controlled modules. ai
semgrep semgrep:new-function-constructor AI (semgrep): Standard globalThis polyfill pattern in expose-loader runtime; not dynamic code execution of untrusted input. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes a Kendo UI license key from an env variable; not a malicious payload. ai
semgrep semgrep:child-process-import AI (semgrep): child_process used in postinstall.js for build-tool setup; expected pattern for this package. ai

Versions (showing 22 of 22)

Version Deps Published
37.0.0 78 / 11
36.4.0 75 / 11
36.3.1 72 / 11
36.1.1 71 / 10
36.1.0 71 / 10
35.3.0 71 / 10
35.2.0 71 / 10
35.0.0 71 / 10
34.3.0 71 / 10
34.2.0 71 / 10
34.0.1 71 / 9
34.0.0 71 / 9
33.1.1 71 / 8
33.1.0 71 / 8
33.0.1 71 / 8
32.7.0 69 / 8
32.6.0 69 / 8
32.5.0 68 / 8
32.4.0 68 / 8
32.3.2 68 / 8
32.3.1 67 / 8
32.3.0 67 / 8

v37.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v34.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v32.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v32.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v32.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.