@steedos/core
10
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
steedos-zhuangjianguosteedos-baozhoutaochenzhipeiyinlianghuisteedos-sunhaolin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:jsen | AI (dependencies): jsen is a JSON schema validator; stable, benign dependency used across many steedos versions. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex encoding/decoding in a crypto module is standard AES-GCM decryption, not obfuscation. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in keychain implementation for OS credential storage — expected for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require used to load registered server scripts — documented plugin/extension pattern for this platform. | ai | |
| phantom-deps | phantom-dep:jsen | AI (phantom-deps): Declared in package.json as a runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:cookies | AI (phantom-deps): Stable false positive; dependency used transitively or via config in this platform package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @steedos/core is a long-established scoped package, not a typosquat of 'cors'. | ai | |
| phantom-deps | phantom-dep:body-parser | AI (phantom-deps): Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:simpl-schema | AI (phantom-deps): Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:express-session | AI (phantom-deps): Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:routing-controllers | AI (phantom-deps): Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@steedos/standard-objects | AI (phantom-deps): Same-org scoped package; phantom-dep heuristic not applicable here. | ai | |
| phantom-deps | phantom-dep:mongodb | AI (phantom-deps): Stable false positive; mongodb is a peer/runtime dep used via config in this platform. | ai |