@swissquote/stylelint-config-swissquote
## Features
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/compiled/stylelint-prettier-package.js | AI (source-diff): Webpack-bundled vendor code (prettier/diff-match-patch), not injected obfuscation. | ai | |
| source-diff | net-exec-file:dist/compiled/stylelint-prettier-package.js | AI (source-diff): Bundled sourcemap-register + prettier deps; no evidence of dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/compiled/sourcemap-register.js | AI (source-diff): Standard sourcemap-register bundling, common webpack output. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Used via stylelint-prettier config, not direct import. | ai | |
| source-diff | net-exec-file:dist/stylelint-prettier/index.js | AI (source-diff): Same bundled dependency; sample shows legitimate diff-match-patch code, no exfil behavior. | ai | |
| source-diff | obfuscated-file:dist/stylelint-prettier/index.js | AI (source-diff): Bundled devDependency (stylelint-prettier) build output, not injected obfuscated code. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Long-lived version + email-matched known maintainer per provenance INFO finding. | ai | |
| provenance | missing-githead | AI (provenance): Long-standing trusted publisher with 224 approved packages; no other suspicious signals. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Standard postcss/stylelint ecosystem deps, matches package's stated purpose. | ai | |
| source-diff | net-exec-file:dist/stylelint/918.js | AI (source-diff): Network+exec pattern fires on bundled stylelint code; no actual dropper behavior present in the sample. | ai | |
| source-diff | obfuscated-file:dist/stylelint/918.js | AI (source-diff): rslib-bundled stylelint chunk; imports are all legitimate node built-ins and stylelint internals. | ai | |
| source-diff | obfuscated-file:dist/csstools-css-tokenizer/index.cjs | AI (source-diff): Webpack-bundled minified CSS tokenizer library; standard build artifact for this package. | ai | |
| phantom-deps | phantom-dep:postcss-scss | AI (phantom-deps): postcss-scss is a declared runtime dep used via config/plugin convention, not direct import; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:@swissquote/crafty | AI (phantom-deps): Same-org monorepo sibling; referenced via config convention, not direct import. Stable FP. | ai | |
| phantom-deps | phantom-dep:@babel/code-frame | AI (phantom-deps): Framework-scoped package loaded by convention; stable FP for this stylelint config package. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 1.30.0 | 4 / 14 | |
| 1.29.0 | 4 / 14 | |
| 1.28.1 | 4 / 13 | |
| 1.27.0 | 3 / 10 | |
| 1.26.0 | 3 / 11 | |
| 1.25.0 | 3 / 11 | |
| 1.22.3 | 3 / 11 | |
| 1.20.0 | 3 / 11 | |
| 1.18.4 | 3 / 11 | |
| 1.18.1 | 3 / 11 | |
| 1.17.2 | 8 / 3 | |
| 1.17.1 | 8 / 3 | |
| 1.16.3 | 8 / 3 | |
| 1.16.1 | 8 / 3 | |
| 1.16.0 | 8 / 3 | |
| 1.15.0 | 8 / 3 | |
| 1.14.0 | 8 / 3 | |
| 1.13.7 | 8 / 3 | |
| 1.13.5 | 8 / 3 | |
| 1.13.4 | 8 / 3 | |
| 1.13.3 | 8 / 3 | |
| 1.13.2 | 8 / 3 | |
| 1.13.0 | 8 / 3 | |
| 1.12.0 | 8 / 3 | |
| 1.11.1 | 8 / 3 | |
| 1.11.0 | 8 / 3 | |
| 1.10.0 | 8 / 3 | |
| 1.9.1 | 8 / 3 | |
| 1.9.0 | 8 / 3 | |
| 1.8.0 | 8 / 3 | |
| 1.7.3 | 8 / 3 | |
| 1.7.2 | 8 / 3 | |
| 1.7.1 | 8 / 3 | |
| 1.7.0 | 8 / 3 | |
| 1.6.0 | 4 / 5 | |
| 1.5.0 | 1 / 1 | |
| 1.4.0 | 1 / 1 | |
| 1.3.0 | 1 / 1 | |
| 1.2.1 | 1 / 1 | |
| 1.2.0 | 1 / 1 | |
| 1.1.0 | 1 / 1 | |
| 1.0.2 | 0 / 1 | |
| 1.0.0 | 0 / 1 |
v1.27.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.3
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2023-04-26, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.20.0
5 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2022-10-07, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.18.4
6 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2022-02-24, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.18.1
6 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2022-02-15, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.17.2
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-11-01, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.17.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-29, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.16.3
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-13, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.16.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-12, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.16.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-06, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.15.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-06-07, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.14.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-03-08, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.13.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.