@stripe/extensibility-eslint-plugin
ESLint plugin and flat config for Stripe Apps development. Includes security checks, code quality rules, and FormSpec type-safety rules.
7
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
nazli-stripestripejsjordand-stripearashn-stripemaxliu-stripejackieosborn-stripebillfinn-stripelins-stripestripe-bindingsjil-stripetomas-stripebibek-striperado-stripefkuo-stripechaves-stripeporter-stripelemuel-stripengrubb-stripecchalstrom-stripecharliecruzan-stripemattpatt-stripeericfrank-stripetomer-stripemindy-stripetennhard-stripejackokerman-stripeianjabour-stripestegs-stripejeremyg-stripeebarrenechea-stripestevekaliski-stripematebek-stripehenryx-stripekovalev-stripeaelliott-stripetylerkrupickastripeaywang-striperaulfdm-stripecttsai-stripetjc-stripetimbennett-stripebethanychen-striperussill-stripekysley-stripecjmisenas-stripejar-stripevladpotapov-stripedavidme-stripejohno-stripesvenugopal-stripealexander-stripetoluo-stripetillh-stripewooj-stripejoyceqin-stripejaynewstrom-stripegbirch-stripeluisv-stripelamflam-stripetjclawson-stripematv-stripelng-stripemats-stripesamer-stripe
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Stripe internal team rotation; cttsai renamed to cttsai-stripe, consistent with org account management. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): aelliott-stripe is a Stripe org contributor; addition is consistent with normal team growth on an official Stripe package. | ai | |
| source-diff | net-exec-file:dist/configs/billing.invoice_collection_options.cjs | AI (source-diff): No actual network calls; bundler boilerplate triggers false positive on this ESLint config bundle. | ai | |
| source-diff | obfuscated-file:dist/configs/billing.invoice_collection_options.cjs | AI (source-diff): Standard esbuild/tsup bundle inlining eslint plugin deps; long lines are bundler output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/configs/billing.invoice_collection_options.js | AI (source-diff): Same tsup ESM bundle; long lines are bundler output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/configs/billing.invoice_collection_options.js | AI (source-diff): No actual network calls; bundler boilerplate triggers false positive on this ESLint config bundle. | ai | |
| phantom-deps | phantom-dep:@formspec/eslint-plugin | AI (phantom-deps): Same ESLint config-object reference pattern; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-security | AI (phantom-deps): ESLint plugin deps are referenced in config objects, not direct imports; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-no-secrets | AI (phantom-deps): Same ESLint config-object reference pattern; stable FP for this package. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 1.0.3 | 5 / 3 | |
| 1.0.1 | 5 / 3 | |
| 0.17.1 | 5 / 3 | |
| 0.16.0 | 5 / 3 | |
| 0.15.6 | 5 / 3 | |
| 0.15.5 | 5 / 3 | |
| 0.15.4 | 5 / 3 |
v1.0.3
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.