@steedos/objectql
- 对象及相关属性的结构定义，如 字段、视图、权限等 - 数据源加载 - graphql的定义 - 触发器、字段公式、字段更新、工作流规则的执行
2
Versions
ISC
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
steedos-zhuangjianguosteedos-baozhoutaochenzhipeiyinlianghuisteedos-sunhaolin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:reflect-metadata | AI (phantom-deps): Known implicit runtime dep for TypeScript decorators; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:bunyan-sfdx-no-dtrace | AI (phantom-deps): Stable false positive for this framework package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() used to parse and test regex patterns from metadata listenTo strings — legitimate ORM trigger matching pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads user-specified config/JS files by path — standard plugin/config loader pattern for this ORM. | ai | |
| phantom-deps | phantom-dep:eval | AI (phantom-deps): eval is a declared dependency used indirectly; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:moleculer | AI (phantom-deps): moleculer is a declared dep used via config/integration layer; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:routing-controllers | AI (phantom-deps): routing-controllers declared dep used via config; phantom-dep false positive for this framework package. | ai | |
| phantom-deps | phantom-dep:moleculer-apollo-server | AI (phantom-deps): Declared optional integration dep; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@steedos/metadata-core | AI (phantom-deps): Same org scope; phantom-dep false positive for intra-org dependency. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 used to decode a MongoDB field encryption key — standard crypto initialization, not payload hiding. | ai |
v2.7.28
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.25
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.