← Home

@tradejs/app

npm Repository

Installable Next.js UI for the TradeJS open-source framework: dashboards, backtests, charts, and runtime data.

19
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

tradejs-dev

Keywords

tradejstradingbacktestingappdashboardnextjssignals

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:next-themes AI (phantom-deps): config-referenced UI dep, common false positive ai
semgrep semgrep:env-spread AI (semgrep): env passed to local yarn build spawn, not sent externally ai
phantom-deps phantom-dep:typescript AI (phantom-deps): build/config tooling dep, not directly imported by design ai
phantom-deps phantom-dep:@types/node AI (phantom-deps): types-only dep, loaded by convention ai
phantom-deps phantom-dep:@types/react AI (phantom-deps): types-only dep, loaded by convention ai
phantom-deps phantom-dep:@types/lodash AI (phantom-deps): types-only dep, loaded by convention ai
phantom-deps phantom-dep:@types/bcryptjs AI (phantom-deps): types-only dep, loaded by convention ai
phantom-deps phantom-dep:@types/react-dom AI (phantom-deps): types-only dep, loaded by convention ai
phantom-deps phantom-dep:@types/react-window AI (phantom-deps): types-only dep, loaded by convention ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'pg' is coincidental, not a typosquat. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'yup' is coincidental, not a typosquat. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'ajv' is coincidental, not a typosquat. ai
phantom-deps phantom-dep:react-is AI (phantom-deps): Next.js/React app; react-is is a peer/config dep not directly imported in source. ai
phantom-deps phantom-dep:react-dom AI (phantom-deps): Next.js app; react-dom used by framework, not directly imported in app source. ai
phantom-deps phantom-dep:@emotion/react AI (phantom-deps): Chakra UI peer dep; referenced in config, not directly imported. ai
phantom-deps phantom-dep:@tradejs/connectors AI (phantom-deps): Same-org sibling package; phantom-dep heuristic unreliable for intra-monorepo deps. ai
typosquat typosquat.levenshtein:hapi AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'hapi' is coincidental, not a typosquat. ai

Versions (showing 19 of 19)

Version Deps Published
2.0.7 37 / 0
2.0.6 37 / 0
2.0.5 37 / 0
2.0.4 37 / 0
2.0.3 37 / 0
2.0.2 37 / 0
2.0.1 37 / 0
2.0.0 37 / 0
1.0.12 37 / 0
1.0.11 37 / 0
1.0.10 37 / 0
1.0.9 29 / 0
1.0.8 29 / 0
1.0.6 29 / 0
1.0.5 29 / 0
1.0.4 29 / 0
1.0.3 29 / 0
1.0.2 29 / 0
1.0.0 29 / 0

v2.0.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.12

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.10

2 findings
HIGH env-spread: src/app/lib/backtestJobs.ts:444 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/TradeJS-Dev/TradeJS/blob/824dc37b1272206b4603b45e80174cbcb68a293b/src/app/lib/backtestJobs.ts#L444 442 | const child = spawn(yarnCommand, args, { 443 | cwd: projectRoot, > 444 | env: { 445 | ...process.env, 446 | PROJECT_CWD: projectRoot,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.