← Home

@turbo/gen

npm Repository Homepage

Extend a Turborepo

100
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/dist-nw78g_9w.js AI (source-diff): Bundled dependency code (get-uri), minified not obfuscated. ai
source-diff obfuscated-file:dist/dist-CqU63zlG.js AI (source-diff): Bundled dependency code (https-proxy-agent), minified not obfuscated. ai
source-diff obfuscated-file:dist/dist-TKIODOC0.js AI (source-diff): Bundled dependency code (smart-buffer), minified not obfuscated. ai
phantom-deps phantom-dep:inquirer AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:commander AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:minimatch AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:proxy-agent AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:update-check AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:@turbo/workspaces AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:validate-npm-package-name AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:picocolors AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:ts-node AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:fs-extra AI (phantom-deps): Declared dep used in bundled dist output; phantom-dep heuristic is a false positive for this package. ai
typosquat typosquat.levenshtein:got AI (typosquat): @turbo/gen is the official Vercel Turborepo generator package; no relation to 'got'. ai
phantom-deps phantom-dep:@inquirer/prompts AI (phantom-deps): Declared runtime dependency used via config/indirect import; stable false positive for this package. ai
phantom-deps phantom-dep:esbuild AI (phantom-deps): esbuild is a declared runtime/bundler dependency; phantom-dep heuristic is a false positive here. ai

Versions (showing 100 of 103)

Version Deps Published
2.10.7 2 / 23
2.10.6 2 / 23
2.10.5 2 / 23
2.10.4 2 / 23
2.10.3 2 / 23
2.10.2 2 / 23
2.10.1 2 / 23
2.10.0 2 / 23
2.9.18 2 / 23
2.9.17 2 / 23
2.9.16 2 / 23
2.9.15 2 / 23
2.9.14 2 / 23
2.9.12 2 / 23
2.9.11 2 / 23
2.9.10 2 / 23
2.9.9 2 / 23
2.9.8 2 / 23
2.9.7 2 / 23
2.9.6 2 / 23
2.9.5 2 / 21
2.9.4 2 / 21
2.9.3 2 / 21
2.9.2 2 / 21
2.9.1 2 / 21
2.9.0 2 / 21
2.8.21 2 / 21
2.8.20 2 / 21
2.8.19 2 / 21
2.8.18 2 / 21
2.8.17 2 / 21
2.8.16 2 / 21
2.8.15 2 / 21
2.8.14 2 / 21
2.8.13 2 / 21
2.8.12 2 / 21
2.8.11 2 / 21
2.8.10 2 / 21
2.8.9 1 / 22
2.8.8 0 / 23
2.8.7 11 / 13
2.8.6 11 / 13
2.8.5 11 / 13
2.8.4 11 / 10
2.8.3 11 / 13
2.8.2 11 / 13
2.8.1 11 / 13
2.8.0 11 / 13
2.7.6 11 / 13
2.7.5 11 / 13
2.7.4 11 / 13
2.7.3 11 / 14
2.7.2 11 / 14
2.7.1 11 / 14
2.7.0 11 / 14
2.6.3 11 / 15
2.6.2 11 / 15
2.6.1 11 / 15
2.6.0 11 / 15
2.5.8 11 / 15
2.5.7 11 / 15
2.5.6 11 / 13
2.5.5 11 / 13
2.5.4 11 / 13
2.5.3 11 / 13
2.5.2 11 / 13
2.5.1 11 / 13
2.5.0 11 / 13
2.4.4 11 / 13
2.4.3 11 / 13
2.4.2 11 / 13
2.4.1 11 / 13
2.4.0 11 / 13
2.3.7 11 / 13
2.3.6 11 / 13
2.3.4 11 / 13
2.3.3 11 / 13
2.3.2 11 / 13
2.3.1 11 / 13
2.3.0 11 / 13
2.2.3 11 / 13
2.2.2 11 / 13
2.2.1 11 / 13
2.2.0 11 / 13
2.1.3 11 / 13
2.1.2 11 / 13
2.1.1 11 / 13
2.1.0 11 / 13
2.0.14 11 / 13
2.0.13 11 / 13
2.0.12 11 / 13
2.0.11 11 / 13
2.0.10 11 / 13
2.0.9 11 / 13
2.0.8 11 / 13
2.0.7 11 / 13
2.0.6 11 / 13
2.0.5 11 / 13
2.0.4 11 / 13
2.0.3 11 / 13
Showing 100 of 103 Next page →

v2.10.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.6

4 findings
HIGH New obfuscated file: dist/dist-CqU63zlG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-TKIODOC0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-nw78g_9w.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.