@tombi-toml/tombi
🦅 TOML Toolkit 🦅
28
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
yassun7010
Keywords
tomlcliformatterlinter
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Package explicitly sets provenance:true and publishes via GitHub Actions CI/CD with SLSA attestation — the publisher change from yassun7010 to GitHub Actions is an intentional, documented supply chain improvement. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall selects platform-specific prebuilt binaries from optional deps — standard pattern for CLI tools like esbuild/biome. SLSA provenance confirms legitimate CI/CD origin. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process use is expected in a binary-selection postinstall script; not fetching remote code. Stable false positive for this package. | ai |
Versions (showing 28 of 128)
| Version | Deps | Published |
|---|---|---|
| 0.4.38 | 0 / 0 | |
| 0.4.37 | 0 / 0 | |
| 0.4.36 | 0 / 0 | |
| 0.4.35 | 0 / 0 | |
| 0.4.34 | 0 / 0 | |
| 0.4.33 | 0 / 0 | |
| 0.4.31 | 0 / 0 | |
| 0.4.30 | 0 / 0 | |
| 0.4.29 | 0 / 0 | |
| 0.4.28 | 0 / 0 | |
| 0.4.27 | 0 / 0 | |
| 0.4.26 | 0 / 0 | |
| 0.4.24 | 0 / 0 | |
| 0.4.23 | 0 / 0 | |
| 0.4.22 | 0 / 0 | |
| 0.4.21 | 0 / 0 | |
| 0.4.20 | 0 / 0 | |
| 0.4.19 | 0 / 0 | |
| 0.4.17 | 0 / 0 | |
| 0.4.15 | 0 / 0 | |
| 0.4.14 | 0 / 0 | |
| 0.4.13 | 0 / 0 | |
| 0.4.12 | 0 / 0 | |
| 0.4.11 | 0 / 0 | |
| 0.4.10 | 0 / 0 | |
| 0.4.9 | 0 / 0 | |
| 0.4.8 | 0 / 0 | |
| 0.4.7 | 0 / 0 |