← Home

@shopify/create-app

npm Repository Homepage

A CLI tool to create a new Shopify app.

36
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jaimie.wayshopify-adminshopify-depmishsmellebuitammychris.craig

Keywords

shopifyshopify-clishopify-partnersshopify-apps

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist/chunk-DNF3EUMN.js AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. ai
source-diff large-new-source-files AI (source-diff): Major version bump with full rebundle; expected for @shopify/create-app release cadence. ai
source-diff net-exec-file:dist/chunk-YUPQUA3D.js AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. ai
source-diff net-exec-file:dist/chunk-UX6FRPFM.js AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. ai
source-diff net-exec-file:dist/chunk-STHW3YIX.js AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. ai
source-diff net-exec-file:dist/chunk-LNOZTAML.js AI (source-diff): Bundled third-party deps in esbuild output; standard pattern for @shopify/create-app. ai
source-diff net-exec-file:dist/chunk-27ZXSSGX.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. ai
source-diff net-exec-file:dist/chunk-QCVAV5PM.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. ai
source-diff net-exec-file:dist/chunk-XDAJMLCV.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable source paths confirm no obfuscation. ai
source-diff net-exec-file:dist/chunk-GUVQJPFV.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. ai
source-diff net-exec-file:dist/chunk-77I3TRE2.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. ai
source-diff net-exec-file:dist/chunk-4IXPA7MG.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable code, no obfuscation, SLSA-attested CI publish. ai
source-diff net-exec-file:dist/chunk-V6HCEO5N.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. ai
source-diff net-exec-file:dist/chunk-IFG7N3S2.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. ai
source-diff net-exec-file:dist/chunk-3QXHJGOG.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. ai
phantom-deps phantom-dep:esbuild AI (phantom-deps): esbuild is a declared runtime dependency used as a bundler binary; phantom-dep heuristic is a stable false positive here. ai
source-diff net-exec-file:dist/chunk-X7WPZPGY.js AI (source-diff): Standard esbuild bundle of legitimate npm deps; readable, non-obfuscated code from known packages. ai

Versions (showing 36 of 136)

Version Deps Published
3.21.0 2 / 1
3.20.1 2 / 1
3.20.0 2 / 1
3.19.0 2 / 1
3.18.0 2 / 1
3.17.0 2 / 1
3.16.3 2 / 1
3.16.2 2 / 1
3.16.1 2 / 1
3.16.0 2 / 1
3.15.0 2 / 1
3.14.0 2 / 1
3.13.1 2 / 1
3.13.0 2 / 1
3.12.0 2 / 1
3.11.0 2 / 1
3.10.1 2 / 1
3.10.0 2 / 1
3.9.2 2 / 1
3.9.1 2 / 1
3.9.0 2 / 1
3.8.0 2 / 1
3.7.1 2 / 1
3.6.2 2 / 1
3.6.1 2 / 1
3.6.0 2 / 1
3.5.0 2 / 1
3.4.0 2 / 1
3.3.3 2 / 1
3.3.2 2 / 1
3.3.1 2 / 1
3.3.0 2 / 1
3.2.0 2 / 1
3.1.0 2 / 1
3.0.27 2 / 1
3.0.26 2 / 1

v3.21.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.20.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.20.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.18.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.17.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.13.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.10.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.9.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.9.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.27

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.