@solid-devtools/debugger

Debugger of the Solid's reactivity graph — a cornerstone of all solid-devtools.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

thetarnav.

Keywords

soliddevtoolsdebuggerreactivity

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@solid-primitives/set	AI (phantom-deps): Used via config, not a real phantom-dep concern.	ai	2026/07/20
dependencies	unvetted-dep:@solid-primitives/set	AI (dependencies): Official solid-primitives sibling package, low risk.	ai	2026/07/20
source-diff	obfuscated-file-transition:dist/index.cjs	AI (source-diff): esbuild/tsup bundler minified output, not obfuscation; no eval/exec/exfil in payload	ai	2026/07/20
phantom-deps	phantom-dep:type-fest	AI (phantom-deps): type-fest is a types-only dep used in .d.ts/config, not runtime-imported by design	ai	2026/07/20
source-diff	obfuscated-file-transition:dist/server.cjs	AI (source-diff): esbuild/tsup bundler minified output, not obfuscation; no eval/exec/exfil in payload	ai	2026/07/20
phantom-deps	phantom-dep:@solid-devtools/transform	AI (phantom-deps): Same org scope, optional dep, false positive.	ai	2026/07/20
dependencies	unvetted-dep:object-observer	AI (dependencies): Legitimate observable/proxy utility lib, no exec/network behavior.	ai	2026/07/20
dependencies	unvetted-dep:@solid-devtools/transform	AI (dependencies): Same-org sibling package, optional dep.	ai	2026/07/20
dependencies	unvetted-dep:@solid-primitives/static-store	AI (dependencies): @solid-primitives is a well-known SolidJS community primitives library; standard dependency for SolidJS ecosystem packages.	ai	2026/04/25
dependencies	unvetted-dep:@solid-primitives/scheduled	AI (dependencies): @solid-primitives is a well-known SolidJS community primitives library; standard dependency for SolidJS ecosystem packages.	ai	2026/04/25
dependencies	unvetted-dep:@solid-primitives/rootless	AI (dependencies): @solid-primitives is a well-known SolidJS community primitives library; standard dependency for SolidJS ecosystem packages.	ai	2026/04/25
dependencies	unvetted-dep:@solid-primitives/keyboard	AI (dependencies): @solid-primitives is a well-known SolidJS community primitives library; standard dependency for SolidJS ecosystem packages.	ai	2026/04/25
dependencies	unvetted-dep:@solid-primitives/bounds	AI (dependencies): @solid-primitives is a well-known SolidJS community primitives library; standard dependency for SolidJS ecosystem packages.	ai	2026/04/25
dependencies	unvetted-dep:@solid-devtools/shared	AI (dependencies): Part of the same solid-devtools monorepo; legitimate sibling dependency for this package.	ai	2026/04/25
dependencies	unvetted-dep:@solid-primitives/event-listener	AI (dependencies): @solid-primitives is a well-known SolidJS community primitives library; standard dependency for SolidJS ecosystem packages.	ai	2026/04/25
phantom-deps	phantom-dep:@solid-primitives/bounds	AI (phantom-deps): Declared in package.json dependencies and referenced in config files; not a security concern for this devtools package.	ai	2026/04/25

Versions (showing 51 of 65)

View all versions

Version	Deps	Published
0.28.1	9 / 0	2025-07-01
0.28.0	9 / 0	2025-06-17
0.27.1	9 / 0	2025-06-14
0.27.0	10 / 0	2025-04-01
0.26.0	11 / 0	2025-01-03
0.25.0	11 / 0	2025-01-01
0.24.5	12 / 0	2024-12-30
0.24.4	12 / 0	2024-12-18
0.24.3	12 / 0	2024-12-16
0.24.2	12 / 1	2024-12-15
0.24.1	12 / 1	2024-12-13
0.24.0	12 / 1	2024-12-11
0.23.4	12 / 1	2024-04-01
0.23.3	12 / 1	2023-11-18
0.23.2	12 / 1	2023-11-16
0.23.1	12 / 1	2023-11-03
0.23.0	12 / 1	2023-11-02
0.22.4	12 / 1	2023-07-26
0.22.3	13 / 0	2023-07-26
0.22.2	13 / 0	2023-07-18
0.22.1	13 / 0	2023-06-12
0.22.0	12 / 0	2023-05-26
0.21.1	10 / 0	2023-05-25
0.21.0	10 / 0	2023-02-16
0.20.2	10 / 0	2023-02-13
0.20.1	10 / 0	2023-02-12
0.20.0	10 / 0	2023-02-12
0.19.0	10 / 0	2023-01-01
0.18.1	10 / 0	2022-12-31
0.18.0	10 / 0	2022-12-28
0.17.2	10 / 0	2022-12-24
0.17.1	10 / 0	2022-12-22
0.17.0	11 / 0	2022-12-20
0.16.0	11 / 0	2022-12-12
0.15.3	11 / 0	2022-11-23
0.15.2	11 / 0	2022-11-21
0.15.1	11 / 0	2022-11-19
0.15.0	11 / 0	2022-11-17
0.14.0	11 / 0	2022-11-11
0.13.1	12 / 3	2022-10-21
0.13.0	12 / 3	2022-10-21
0.12.0	6 / 12	2022-10-12
0.11.1	6 / 12	2022-10-06
0.11.0	6 / 12	2022-10-03
0.10.0	8 / 12	2022-09-30
0.9.2	8 / 12	2022-09-26
0.9.1	8 / 12	2022-09-23
0.9.0	9 / 7	2022-09-18
0.8.1	10 / 7	2022-09-16
0.8.0	10 / 7	2022-09-16
0.7.2	10 / 7	2022-08-30

v0.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.24.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.24.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.23.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.21.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.21.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.18.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.17.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.17.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.17.0

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.0

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.3

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.2

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.1

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.0

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.0

3 findings

HIGH Modified file became obfuscated: dist/index.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: dist/server.cjs source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.