@treeseed/core — Greenflagged

Treeseed integrated platform starter for Astro/Starlight web runtimes and Hono API runtimes.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

adrianwebb

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:env-spread	AI (semgrep): process.env spread into env of a spawned npm install to disable install scripts; not exfiltrated anywhere.	ai	2026/07/06
publish-pattern	new-deps-added	AI (publish-pattern): New deps are core Astro ecosystem packages; consistent with this Astro/Starlight framework's documented purpose.	ai	2026/05/14
dependencies	unvetted-dep:@astrojs/sitemap	AI (dependencies): Well-known Astro ecosystem package; no malware indicators.	ai	2026/05/14
dependencies	unvetted-dep:@astrojs/starlight	AI (dependencies): Well-known Astro ecosystem package; no malware indicators.	ai	2026/05/14
dependencies	unvetted-dep:@astrojs/cloudflare	AI (dependencies): Well-known Astro ecosystem package; no malware indicators.	ai	2026/05/14
phantom-deps	phantom-dep:katex	AI (phantom-deps): Math rendering dep referenced in config, not directly imported — expected for docs starter.	ai	2026/04/29
phantom-deps	phantom-dep:remark-gfm	AI (phantom-deps): Remark plugin referenced in config, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:remark-mdx	AI (phantom-deps): Remark plugin referenced in config, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:remark-stringify	AI (phantom-deps): Remark plugin referenced in config, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:remark-frontmatter	AI (phantom-deps): Remark plugin referenced in config, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:@astrojs/check	AI (phantom-deps): Astro type-checker referenced in scripts/config, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:remark-parse	AI (phantom-deps): Remark plugin referenced in config, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:wrangler	AI (phantom-deps): Framework starter; wrangler referenced in config/scripts, not imported directly — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:vitest	AI (phantom-deps): Test runner referenced in vitest.config.ts, not directly imported — expected pattern.	ai	2026/04/29
phantom-deps	phantom-dep:tailwindcss	AI (phantom-deps): CSS framework referenced in config files, not directly imported — expected for Astro starter.	ai	2026/04/29
phantom-deps	phantom-dep:unified	AI (phantom-deps): Remark/unified pipeline dep referenced in config, not directly imported — expected pattern.	ai	2026/04/29
typosquat	typosquat.levenshtein:cors	AI (typosquat): Scoped package @treeseed/core is not a typosquat of 'cors'. The edit-distance match is on the unscoped portion only; the full name, repo, and purpose are clearly distinct.	ai	2026/04/25