← Home

@stonecrop/stonecrop

npm Repository
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

knuckledownalchez

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist/composables/lazy-link.js AI (source-diff): GraphQL composable with documented new Function() for custom handler deserialization; source-linked to public repo. ai
source-diff net-exec-file:dist/stonecrop.umd.cjs AI (source-diff): Standard Vue/Pinia UMD bundle; network calls are GraphQL fetches, not dropper behavior. ai
source-diff net-exec-file:dist/composables/use-lazy-link-state.js AI (source-diff): Same pattern as lazy-link.js; legitimate composable, not malware. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() used in a Proxy trap for HST store navigation — standard JS Proxy pattern, not obfuscation. ai
source-diff net-exec-file:dist/src/composables/lazy-link.js AI (source-diff): Legitimate Vue composable: network calls are GraphQL fetches; new Function() deserializes user-configured handlers per documented API. ai
semgrep semgrep:new-function-constructor AI (semgrep): Used in lazy-link composable with fixed named params; consistent with documented router/template pattern for this package. ai
phantom-deps phantom-dep:pinia-xstate AI (phantom-deps): Declared as runtime dep; referenced in config files — phantom-dep heuristic is a false positive here. ai

Versions (showing 51 of 180)

View all versions
Version Deps Published
0.14.0 6 / 17
0.13.14 6 / 17
0.13.12 6 / 17
0.13.11 6 / 17
0.13.10 6 / 17
0.13.9 6 / 17
0.13.8 6 / 17
0.13.7 6 / 17
0.13.6 6 / 17
0.13.5 6 / 17
0.13.4 6 / 21
0.13.3 6 / 21
0.13.2 6 / 21
0.13.1 6 / 21
0.12.8 6 / 21
0.12.7 6 / 21
0.12.6 6 / 21
0.12.5 6 / 21
0.12.4 6 / 21
0.12.3 6 / 21
0.12.2 6 / 21
0.12.1 6 / 21
0.12.0 6 / 21
0.11.10 6 / 21
0.11.9 6 / 21
0.11.8 6 / 21
0.11.7 6 / 21
0.11.6 6 / 21
0.11.5 6 / 21
0.10.16 6 / 21
0.10.15 6 / 21
0.10.14 6 / 21
0.10.13 6 / 21
0.10.12 6 / 21
0.10.11 6 / 21
0.10.10 6 / 21
0.10.9 6 / 21
0.10.8 6 / 21
0.10.7 6 / 21
0.10.6 6 / 21
0.10.5 6 / 21
0.10.4 6 / 21
0.10.3 6 / 21
0.10.2 5 / 21
0.10.1 5 / 21
0.10.0 5 / 21
0.9.2 5 / 21
0.9.1 5 / 21
0.9.0 5 / 21
0.8.13 8 / 18
0.8.12 8 / 18

v0.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.