@terrazzo/parser
Parser/validator for the Design Tokens Community Group (DTCG) standard.
9
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
drewpowers
Keywords
design tokensdtcgcliw3cdesign systemtypescriptsasscssstyle tokensstyle systemlintinglint
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is a first-party sibling package from the same monorepo; not a third-party supply chain risk. | ai | |
| phantom-deps | phantom-dep:fast-deep-equal | AI (phantom-deps): Declared as runtime dep; may be used indirectly via re-exports or conditionally — stable false positive for this package. | ai | |
| provenance | slsa-provenance | AI (provenance): Package consistently published via CI with SLSA attestation; strong supply chain integrity signal. | ai | |
| phantom-deps | phantom-dep:@types/culori | AI (phantom-deps): @types/culori is a type-only dependency; not directly imported at runtime but used for TypeScript consumers. Stable pattern for this package. | ai | |
| dependencies | unvetted-dep:@types/babel__code-frame | AI (dependencies): TypeScript type definitions for @babel/code-frame; a legitimate, well-known package. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@types/culori | AI (dependencies): TypeScript type definitions for culori; a legitimate, well-known package. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:merge-anything | AI (dependencies): merge-anything is a popular, legitimate utility package. No security concerns. | ai | |
| phantom-deps | phantom-dep:@types/babel__code-frame | AI (phantom-deps): Type-only package, framework-scoped; no runtime risk. Stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:parcel | AI (typosquat): @terrazzo/parser is a scoped package whose name describes its function (DTCG token parser); the levenshtein match to 'parcel' is a false positive that will recur on every version. | ai |