@trayio/commons — Greenflagged

Extensions to the standard/core libraries and basic features

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

trayprodjohnbastian_trayiothomaschaplin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	no-provenance	AI (provenance): Established package; provenance is a best-practice enhancement, not a security blocker.	ai	2026/05/17
publish-pattern	new-deps-added	AI (publish-pattern): generate-schema is a legitimate, established utility; addition is consistent with this package's pattern of commons utilities.	ai	2026/05/04
dependencies	unvetted-dep:io-ts-types	AI (dependencies): Legitimate io-ts companion library; stable dependency for this package.	ai	2026/04/30
dependencies	unvetted-dep:deep-copy-ts	AI (dependencies): Well-known utility library; stable dependency for this package.	ai	2026/04/30
dependencies	unvetted-dep:monocle-ts	AI (dependencies): Legitimate fp-ts ecosystem library; stable dependency for this package.	ai	2026/04/30
dependencies	unvetted-dep:io-ts-reporters	AI (dependencies): Legitimate io-ts companion library; stable dependency for this package.	ai	2026/04/30
dependencies	unvetted-dep:generate-schema	AI (dependencies): Well-known schema generation library; stable dependency for this package.	ai	2026/04/30
dependencies	unvetted-dep:newtype-ts	AI (dependencies): Legitimate fp-ts ecosystem library; stable dependency for this package.	ai	2026/04/30
phantom-deps	phantom-dep:ajv	AI (phantom-deps): Declared runtime dep used via package exports pattern; phantom-dep heuristic misfires on this package's dist structure.	ai	2026/04/30
phantom-deps	phantom-dep:@types/mime-types	AI (phantom-deps): Framework-scoped type package; stable false positive for this package.	ai	2026/04/30
phantom-deps	phantom-dep:uuid	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic misfires on this package's dist structure.	ai	2026/04/30
phantom-deps	phantom-dep:formidable	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic misfires on this package's dist structure.	ai	2026/04/30
phantom-deps	phantom-dep:monocle-ts	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic misfires on this package's dist structure.	ai	2026/04/30
phantom-deps	phantom-dep:newtype-ts	AI (phantom-deps): Declared runtime dep; phantom-dep heuristic misfires on this package's dist structure.	ai	2026/04/30
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): Framework-scoped type package; stable false positive for this package.	ai	2026/04/30
phantom-deps	phantom-dep:@types/uuid	AI (phantom-deps): Framework-scoped type package; stable false positive for this package.	ai	2026/04/30
phantom-deps	phantom-dep:@types/formidable	AI (phantom-deps): Framework-scoped type package; stable false positive for this package.	ai	2026/04/30