@tramvai/plugin-base-builder
16
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
super_olegmeskilltinkoffbank
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is uuid, a well-known widely-used package, not suspicious. | ai | |
| dependencies | unvetted-dep:@tramvai/api | AI (dependencies): First-party sibling package in the same monorepo/version. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Monorepo internal package; missing description is stable and benign. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo plugin package; missing metadata is typical for internal tramvai ecosystem packages. | ai | |
| phantom-deps | phantom-dep:@babel/preset-typescript | AI (phantom-deps): Build plugin; preset loaded by convention, not direct import — stable false positive. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used for self-signed certificate generation — standard build-tool utility. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is in an integration test file for polyfill condition evaluation, not production code. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require resolves babel polyfill definitions at a known absolute path — not arbitrary module loading. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread in server runner worker bridge is expected for a build tool passing env to child workers. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 7.27.3 | 29 / 5 | |
| 7.26.9 | 23 / 5 | |
| 7.20.3 | 21 / 5 | |
| 7.20.2 | 21 / 5 | |
| 7.20.1 | 21 / 5 | |
| 7.17.6 | 21 / 5 | |
| 7.16.1 | 21 / 5 | |
| 7.16.0 | 21 / 5 | |
| 6.82.8 | 30 / 5 | |
| 6.81.11 | 23 / 5 | |
| 6.80.26 | 21 / 5 | |
| 6.80.23 | 21 / 5 | |
| 6.80.19 | 21 / 5 | |
| 6.80.16 | 21 / 5 | |
| 6.80.7 | 21 / 5 | |
| 6.80.6 | 21 / 5 |
v6.82.8
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.