@turbo/codemod
Provides Codemod transformations to help upgrade your Turborepo codebase when a feature is deprecated.
51
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/dist-CM5dI28P.js | AI (source-diff): Minified bundle of legitimate deps (js-yaml, etc.); standard build output for this package. | ai | |
| source-diff | net-exec-file:dist/dist-CM5dI28P.js | AI (source-diff): Network/exec calls are from bundled node:child_process and update-check; expected for a codemod CLI tool. | ai | |
| source-diff | obfuscated-file:dist/runner-sNjkx4u0.js | AI (source-diff): Minified bundle of legitimate deps; standard build output for this package. | ai | |
| source-diff | net-exec-file:dist/runner-sNjkx4u0.js | AI (source-diff): Network/exec calls from bundled node:child_process and update-check; expected for a codemod CLI tool. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Bundled into dist; false positive. | ai | |
| source-diff | obfuscated-file:dist/runner-BbVjU0ci.js | AI (source-diff): Standard minified bundle output from tsdown; sample shows legitimate codemod runner code. | ai | |
| source-diff | net-exec-file:dist/dist-beJVDhbp.js | AI (source-diff): Network calls are update-check; child_process is for running codemods — expected for this CLI tool. | ai | |
| source-diff | obfuscated-file:dist/dist-beJVDhbp.js | AI (source-diff): Standard minified bundle output from tsdown build tool; legitimate YAML/utility code visible in sample. | ai | |
| source-diff | net-exec-file:dist/runner-BbVjU0ci.js | AI (source-diff): Same pattern as dist-beJVDhbp.js; update-check + child_process are documented codemod CLI features. | ai | |
| phantom-deps | phantom-dep:inquirer-file-tree-selection-prompt | AI (phantom-deps): Bundled into dist; false positive. | ai | |
| source-diff | obfuscated-file:dist/dist-DHVkV0NT.js | AI (source-diff): Minified bundler output (tsdown); content matches known libraries (js-yaml, regenerator-runtime). | ai | |
| source-diff | net-exec-file:dist/get-transformer-helpers-a8Tz9e-N.js | AI (source-diff): Same rationale as dist-DHVkV0NT.js — update-check + child_process are expected in this codemod CLI. | ai | |
| source-diff | obfuscated-file:dist/get-transformer-helpers-a8Tz9e-N.js | AI (source-diff): Minified bundler output; content matches known libraries bundled by tsdown. | ai | |
| source-diff | net-exec-file:dist/dist-DHVkV0NT.js | AI (source-diff): Network calls are update-check; code execution is child_process used by codemod tooling — expected for this package. | ai | |
| source-diff | net-exec-file:dist/dist-xiT9itt2.js | AI (source-diff): Network calls and child_process usage are expected in a codemod CLI tool; no dropper pattern evident. | ai | |
| source-diff | obfuscated-file:dist/dist-xiT9itt2.js | AI (source-diff): Standard tsdown bundle output for @turbo/codemod; minified but not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/get-transformer-helpers-COgaexeM.js | AI (source-diff): Standard tsdown bundle output for @turbo/codemod; minified but not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/get-transformer-helpers-COgaexeM.js | AI (source-diff): Network calls and child_process usage are expected in a codemod CLI tool; no dropper pattern evident. | ai | |
| source-diff | net-exec-file:dist/runner-Qa95HmyV.js | AI (source-diff): Same as dist-B5rR31JW.js; update-check + child_process for codemod runner; legitimate use. | ai | |
| source-diff | obfuscated-file:dist/runner-Qa95HmyV.js | AI (source-diff): Minified bundle; imports are all declared deps; no obfuscation beyond standard minification. | ai | |
| source-diff | net-exec-file:dist/dist-B5rR31JW.js | AI (source-diff): Network calls are update-check/version-check; code execution is standard Node.js child_process for codemod transforms. | ai | |
| source-diff | obfuscated-file:dist/dist-B5rR31JW.js | AI (source-diff): Minified bundle of known deps (js-yaml, etc.); no malicious patterns in sample; consistent with tsdown build output. | ai | |
| source-diff | obfuscated-file:dist/dist-CPGs1S7i.js | AI (source-diff): Standard tsdown bundle output for @turbo/codemod; not obfuscation. | ai | |
| source-diff | net-exec-file:dist/runner-ionPv0sZ.js | AI (source-diff): Bundled CLI runner; network+exec pattern is from bundled deps (update-check, child_process), not malware. | ai | |
| source-diff | net-exec-file:dist/dist-CPGs1S7i.js | AI (source-diff): Bundled YAML/CLI code; network+exec pattern is from bundled deps, not malware. | ai | |
| source-diff | obfuscated-file:dist/runner-ionPv0sZ.js | AI (source-diff): Standard tsdown bundle output for @turbo/codemod; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/dist-CmRfU9w3.js | AI (source-diff): Standard bundled/minified dist output for a codemod CLI; content is legitimate library code. | ai | |
| source-diff | obfuscated-file:dist/runner-Ci3IamWM.js | AI (source-diff): Standard bundled/minified dist output for a codemod CLI; content is legitimate library code. | ai | |
| source-diff | net-exec-file:dist/dist-CmRfU9w3.js | AI (source-diff): Network+exec pattern is bundled child_process/update-check usage, not dropper malware. | ai | |
| source-diff | net-exec-file:dist/runner-Ci3IamWM.js | AI (source-diff): Network+exec pattern is bundled child_process/update-check usage, not dropper malware. | ai | |
| source-diff | net-exec-file:dist/runner-BXVdw9eY.js | AI (source-diff): Same bundle; network+exec pattern is from bundled deps (update-check, child_process) not malware. | ai | |
| source-diff | obfuscated-file:dist/dist-TnfTwrBN.js | AI (source-diff): Standard esbuild/tsdown bundle output for this package; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/runner-BXVdw9eY.js | AI (source-diff): Standard esbuild/tsdown bundle output for this package; not malicious obfuscation. | ai | |
| source-diff | net-exec-file:dist/dist-TnfTwrBN.js | AI (source-diff): Network calls are update-check; code execution is child_process for codemod transforms — expected for this tool. | ai | |
| source-diff | net-exec-file:dist/runner-BB60mHRe.js | AI (source-diff): Same as dist-DTutL_kT.js — legitimate CLI tool bundling update-check and child_process from known deps. | ai | |
| source-diff | obfuscated-file:dist/runner-BB60mHRe.js | AI (source-diff): Standard esbuild/tsdown minified bundle output; sample shows known deps like regenerator-runtime, picocolors, fs-extra. | ai | |
| source-diff | net-exec-file:dist/dist-DTutL_kT.js | AI (source-diff): Network calls and child_process are legitimate CLI features (update-check, codemod execution); bundled from known deps. | ai | |
| source-diff | obfuscated-file:dist/dist-DTutL_kT.js | AI (source-diff): Standard esbuild/tsdown minified bundle output for this CLI tool; not obfuscation. | ai | |
| source-diff | net-exec-file:dist/runner-pd7wGl_6.js | AI (source-diff): Same bundled-deps pattern; no malicious payload visible in samples. | ai | |
| source-diff | net-exec-file:dist/dist-DPnC9gtO.js | AI (source-diff): Network+exec pattern is from bundled deps (update-check, child_process); expected for a CLI codemod tool. | ai | |
| source-diff | obfuscated-file:dist/runner-pd7wGl_6.js | AI (source-diff): Standard tsdown bundle output; contains recognizable OSS library code. | ai | |
| source-diff | obfuscated-file:dist/dist-DPnC9gtO.js | AI (source-diff): Standard tsdown bundle output for this package; content matches known deps. | ai | |
| provenance | publisher-changed | AI (provenance): turbobot → GitHub Actions is a documented CI pipeline migration for vercel/turborepo; SLSA provenance confirms legitimate CI publish. | ai | |
| source-diff | net-exec-file:dist/runner-CVJuNfzM.js | AI (source-diff): Bundled deps (update-check, child_process) in a codemod CLI; no malicious dropper pattern. | ai | |
| source-diff | net-exec-file:dist/dist-CKadySos.js | AI (source-diff): Bundled deps (yaml, child_process) in a codemod CLI; no malicious dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/runner-CVJuNfzM.js | AI (source-diff): Standard esbuild/tsdown bundle output for a codemod CLI; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/dist-CKadySos.js | AI (source-diff): Standard esbuild/tsdown bundle output for a codemod CLI; not obfuscation. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:diff | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:@inquirer/prompts | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:gradient-string | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:brace-expansion | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:update-check | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:is-git-clean | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:picocolors | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:fs-extra | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:find-up | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:json5 | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): CLI tool; dependencies used via config-driven transformer loading, not direct imports. | ai |
Versions (showing 51 of 80)
| Version | Deps | Published |
|---|---|---|
| 2.10.0 | 14 / 18 | |
| 2.9.18 | 14 / 18 | |
| 2.9.17 | 14 / 18 | |
| 2.9.16 | 14 / 18 | |
| 2.9.15 | 14 / 18 | |
| 2.9.14 | 14 / 18 | |
| 2.9.12 | 14 / 18 | |
| 2.9.11 | 14 / 18 | |
| 2.9.10 | 14 / 18 | |
| 2.9.9 | 14 / 18 | |
| 2.9.8 | 14 / 18 | |
| 2.9.7 | 14 / 18 | |
| 2.9.6 | 14 / 18 | |
| 2.9.5 | 13 / 18 | |
| 2.9.4 | 13 / 18 | |
| 2.9.3 | 13 / 18 | |
| 2.9.2 | 13 / 18 | |
| 2.9.1 | 13 / 18 | |
| 2.9.0 | 12 / 18 | |
| 2.8.21 | 12 / 18 | |
| 2.8.20 | 12 / 18 | |
| 2.8.19 | 12 / 18 | |
| 2.8.18 | 12 / 18 | |
| 2.8.17 | 12 / 18 | |
| 2.8.16 | 12 / 18 | |
| 2.8.15 | 12 / 18 | |
| 2.8.14 | 12 / 18 | |
| 2.8.13 | 12 / 18 | |
| 2.8.12 | 12 / 18 | |
| 2.8.11 | 12 / 18 | |
| 2.8.10 | 12 / 18 | |
| 2.8.9 | 12 / 18 | |
| 2.8.8 | 12 / 18 | |
| 2.8.7 | 12 / 20 | |
| 2.8.6 | 12 / 20 | |
| 2.8.5 | 12 / 20 | |
| 2.8.4 | 12 / 20 | |
| 2.8.3 | 13 / 21 | |
| 2.8.2 | 13 / 21 | |
| 2.7.3 | 14 / 22 | |
| 2.7.2 | 14 / 22 | |
| 2.7.1 | 14 / 22 | |
| 2.7.0 | 14 / 22 | |
| 2.6.3 | 14 / 22 | |
| 2.6.2 | 14 / 22 | |
| 2.6.1 | 14 / 22 | |
| 2.6.0 | 14 / 22 | |
| 2.5.8 | 14 / 22 | |
| 2.5.7 | 14 / 22 | |
| 2.5.6 | 14 / 22 | |
| 2.5.5 | 14 / 22 |