@visulima/package
12
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
prisis
Keywords
anolilabbunfindfind-monorepo-rootfind-package-managerfind-up-pkgjson5mono-repomonoreponpmpackagepackage-jsonpackage-managerpackage.jsonpackage.json5package.yamlpackagespkg-dirpkg-managerpkg-typespkg-uppnpmread-pkgread-pkg-uprootvisulimayamlyarn
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from prisis to GitHub Actions CI/CD publishing with SLSA provenance; stable pattern. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Switched to bundled/minified dist output; expected size reduction. | ai | |
| source-diff | obfuscated-file:dist/package-json.js | AI (source-diff): Standard minified ESM build output from packem; content is readable package.json utility logic, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/package-manager.js | AI (source-diff): Standard minified ESM build output; content is package manager detection logic, no malicious patterns. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): yaml is used for pnpm catalog YAML parsing; heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@visulima/path | AI (phantom-deps): Same-org dep imported in bundled dist files; phantom-dep heuristic misses bundled imports. | ai | |
| phantom-deps | phantom-dep:@inquirer/confirm | AI (phantom-deps): Used in interactive install flow; bundled import not detected by static heuristic. | ai |