@slingr/framework-backend

Slingr Framework - Backend (models, actions, GraphQL, datasources)

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:eval-usage	AI (semgrep): eval('import.meta.url') is a standard ESM/CJS interop workaround, not arbitrary code execution.	ai	2026/05/27
semgrep	semgrep:dynamic-require	AI (semgrep): Loads framework views path; expected dynamic module loading pattern for a backend framework.	ai	2026/05/27
semgrep	semgrep:base64-decode	AI (semgrep): Decodes a pagination cursor string; no malicious payload risk.	ai	2026/05/27
phantom-deps	phantom-dep:fastify	AI (phantom-deps): Framework peer dep referenced in config; stable false positive for this package.	ai	2026/05/27
phantom-deps	phantom-dep:express-jwt	AI (phantom-deps): Framework peer dep referenced in config; stable false positive.	ai	2026/05/27
phantom-deps	phantom-dep:passport-jwt	AI (phantom-deps): Framework peer dep referenced in config; stable false positive.	ai	2026/05/27
phantom-deps	phantom-dep:@types/bcryptjs	AI (phantom-deps): Type-only package loaded by convention; stable false positive.	ai	2026/05/27
phantom-deps	phantom-dep:@ucast/mongo2js	AI (phantom-deps): Framework dep referenced in config; stable false positive.	ai	2026/05/27
phantom-deps	phantom-dep:@types/jsonwebtoken	AI (phantom-deps): Type-only package; stable false positive.	ai	2026/05/27
phantom-deps	phantom-dep:@types/passport-jwt	AI (phantom-deps): Type-only package; stable false positive.	ai	2026/05/27
phantom-deps	phantom-dep:@slingr/financial-arithmetic-functions	AI (phantom-deps): Same org scope; stable false positive for this package.	ai	2026/05/27

Version	Deps	Published
0.2.1	36 / 24	2026-04-08