@storm-software/pnpm-tools
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:prettier-plugin-pkg | AI (phantom-deps): Config-file reference pattern; stable for this pnpm-tools package. | ai | |
| phantom-deps | phantom-dep:@pnpm/plugin-esm-node-path | AI (phantom-deps): Config-file reference pattern; stable for this pnpm-tools package. | ai | |
| phantom-deps | phantom-dep:@pnpm/plugin-better-defaults | AI (phantom-deps): Config-file reference pattern; stable for this pnpm-tools package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): README quality issues in a monorepo tooling package; not indicative of spam or malice. | ai | |
| phantom-deps | phantom-dep:@storm-software/config | AI (phantom-deps): Same-org transitive dep; phantom-dep heuristic unreliable for bundled monorepo packages. | ai | |
| phantom-deps | phantom-dep:@storm-software/config-tools | AI (phantom-deps): Same-org transitive dep; bundled in bin/pnpm.cjs. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): CLI tool passing process.env to child_process.exec is standard; env is scoped and not exfiltrated. | ai | |
| phantom-deps | phantom-dep:@storm-software/npm-tools | AI (phantom-deps): Same-org dep; declared as runtime dependency and used transitively. | ai | |
| phantom-deps | phantom-dep:prettier-plugin-packagejson | AI (phantom-deps): Referenced in config files as documented; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@storm-software/package-constants | AI (phantom-deps): Same-org transitive dep; bundled in bin/pnpm.cjs. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): pnpm CLI wrapper legitimately uses child_process to run pnpm commands. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reads only STORM_EXTENSION_* prefixed keys; scoped config pattern, not exfiltration. | ai |
Versions (showing 100 of 301)
| Version | Deps | Published |
|---|---|---|
| 0.7.6 | 10 / 3 | |
| 0.7.5 | 10 / 3 | |
| 0.7.4 | 10 / 3 | |
| 0.7.3 | 10 / 3 | |
| 0.7.2 | 10 / 3 | |
| 0.7.1 | 10 / 3 | |
| 0.7.0 | 10 / 3 | |
| 0.6.156 | 10 / 3 | |
| 0.6.155 | 10 / 3 | |
| 0.6.154 | 10 / 3 | |
| 0.6.153 | 10 / 3 | |
| 0.6.152 | 9 / 4 | |
| 0.6.151 | 9 / 4 | |
| 0.6.150 | 9 / 4 | |
| 0.6.149 | 9 / 4 | |
| 0.6.148 | 9 / 4 | |
| 0.6.147 | 9 / 4 | |
| 0.6.146 | 9 / 4 | |
| 0.6.145 | 9 / 3 | |
| 0.6.144 | 9 / 3 | |
| 0.6.143 | 9 / 3 | |
| 0.6.142 | 9 / 3 | |
| 0.6.141 | 9 / 3 | |
| 0.6.140 | 9 / 3 | |
| 0.6.139 | 9 / 3 | |
| 0.6.138 | 9 / 3 | |
| 0.6.137 | 9 / 3 | |
| 0.6.136 | 9 / 3 | |
| 0.6.135 | 9 / 3 | |
| 0.6.134 | 9 / 3 | |
| 0.6.133 | 9 / 3 | |
| 0.6.132 | 9 / 3 | |
| 0.6.131 | 9 / 3 | |
| 0.6.130 | 9 / 3 | |
| 0.6.129 | 9 / 3 | |
| 0.6.128 | 9 / 3 | |
| 0.6.127 | 9 / 3 | |
| 0.6.126 | 9 / 3 | |
| 0.6.125 | 9 / 3 | |
| 0.6.124 | 9 / 3 | |
| 0.6.123 | 9 / 3 | |
| 0.6.122 | 9 / 3 | |
| 0.6.121 | 9 / 3 | |
| 0.6.120 | 9 / 3 | |
| 0.6.119 | 9 / 3 | |
| 0.6.118 | 9 / 3 | |
| 0.6.117 | 9 / 3 | |
| 0.6.116 | 9 / 3 | |
| 0.6.115 | 9 / 3 | |
| 0.6.114 | 9 / 3 | |
| 0.6.113 | 9 / 3 | |
| 0.6.112 | 9 / 3 | |
| 0.6.111 | 9 / 3 | |
| 0.6.110 | 9 / 3 | |
| 0.6.109 | 9 / 3 | |
| 0.6.108 | 9 / 3 | |
| 0.6.107 | 9 / 3 | |
| 0.6.106 | 9 / 3 | |
| 0.6.105 | 9 / 3 | |
| 0.6.104 | 9 / 3 | |
| 0.6.103 | 9 / 3 | |
| 0.6.102 | 9 / 3 | |
| 0.6.101 | 9 / 3 | |
| 0.6.100 | 9 / 3 | |
| 0.6.99 | 9 / 3 | |
| 0.6.98 | 9 / 3 | |
| 0.6.97 | 9 / 3 | |
| 0.6.96 | 9 / 3 | |
| 0.6.95 | 9 / 3 | |
| 0.6.94 | 9 / 3 | |
| 0.6.93 | 9 / 3 | |
| 0.6.92 | 9 / 3 | |
| 0.6.91 | 9 / 3 | |
| 0.6.90 | 9 / 3 | |
| 0.6.89 | 9 / 3 | |
| 0.6.88 | 9 / 3 | |
| 0.6.87 | 9 / 3 | |
| 0.6.86 | 9 / 3 | |
| 0.6.85 | 9 / 3 | |
| 0.6.84 | 9 / 3 | |
| 0.6.83 | 9 / 3 | |
| 0.6.82 | 9 / 3 | |
| 0.6.81 | 9 / 3 | |
| 0.6.80 | 9 / 3 | |
| 0.6.79 | 9 / 3 | |
| 0.6.78 | 9 / 3 | |
| 0.6.77 | 9 / 3 | |
| 0.6.76 | 9 / 3 | |
| 0.6.75 | 9 / 3 | |
| 0.6.74 | 9 / 3 | |
| 0.6.73 | 9 / 3 | |
| 0.6.72 | 9 / 3 | |
| 0.6.71 | 9 / 3 | |
| 0.6.70 | 9 / 3 | |
| 0.6.69 | 9 / 3 | |
| 0.6.68 | 9 / 3 | |
| 0.6.67 | 9 / 3 | |
| 0.6.66 | 9 / 3 | |
| 0.6.65 | 9 / 3 | |
| 0.6.64 | 9 / 3 |
v0.6.88
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.87
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.86
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.85
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.84
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.83
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.82
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.81
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.80
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.79
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.78
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.77
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.76
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.75
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.74
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.73
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.72
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.71
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.70
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.69
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.68
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.67
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.66
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.65
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.64
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.