← Home

@tuturuuu/supabase

npm Repository Homepage
13
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

vohoangphuc

Keywords

supabasenextjsssrdatabaseauthenticationpostgresqlrealtimetypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:react AI (phantom-deps): Declared peer dependency; stable for this package. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IPs appear only in test fixtures (docker.internal, 127.0.0.1) — not in runtime code. ai
semgrep semgrep:base64-decode AI (semgrep): Standard JWT base64url decoding in auth cookie sanitizer; not obfuscation. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() used in a Proxy handler for schema interception — idiomatic JS Proxy pattern. ai
phantom-deps phantom-dep:react-dom AI (phantom-deps): react-dom is a peer dep declared in peerDependencies; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:zod AI (phantom-deps): zod is listed as a runtime dependency and used for schema validation; stable false positive. ai

Versions (showing 13 of 13)

Version Deps Published
0.5.0 7 / 8
0.4.1 7 / 8
0.4.0 7 / 8
0.3.4 7 / 9
0.3.3 7 / 9
0.3.2 7 / 9
0.3.1 7 / 9
0.2.3 4 / 8
0.2.2 4 / 8
0.2.1 4 / 8
0.2.0 4 / 8
0.1.2 4 / 8
0.0.7 7 / 5

v0.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.