← Home

@uswds/compile

npm Repository Homepage

A Gulp-based compiler for USWDS Sass

6
Versions
SEE LICENSE IN LICENSE.md
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

heymatthenryafeijoothisisdanoiamjolly-govethangardner-gsaapetersen-gsa

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:dynamic-require AI (semgrep): Used only to read package.json version from a constructed path; stable build-tool pattern for this package. ai
phantom-deps phantom-dep:postcss AI (phantom-deps): postcss is a direct dependency in package.json and used via gulp-postcss config; phantom-dep is a false positive here. ai

Versions (showing 6 of 6)

Version Deps Published
1.3.2 10 / 2
1.3.1 10 / 2
1.3.0 10 / 2
1.2.2 10 / 2
1.2.1 11 / 2
1.2.0 11 / 2

v1.3.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thisisdano → heymatthenry (on 2025-05-22, known maintainer) provenance

This version was published by a different npm account (heymatthenry) than the most recent previously approved version (thisisdano) on 2025-05-22, but heymatthenry is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.2.2

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thisisdano → heymatthenry (on 2025-04-02, known maintainer) provenance

This version was published by a different npm account (heymatthenry) than the most recent previously approved version (thisisdano) on 2025-04-02, but heymatthenry is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.