@wbce-d9/api
Directus is a real-time API and App dashboard for managing SQL database content
8
Versions
GPL-3.0-only
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
louis75delo06260
Keywords
directusrealtimedatabasecontentapirestgraphqlappdashboardheadlesscmsmysqlpostgresqlcockroachdbsqliteframeworkvue
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Long-lived fork project with consistent publisher history; dormancy reflects maintenance cadence, not takeover signal. | ai | |
| dependencies | unvetted-dep:@wbce-d9/storage | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/exceptions | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/format-title | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/update-check | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/extensions-sdk | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/storage-driver-s3 | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/storage-driver-gcs | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/storage-driver-azure | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/storage-driver-local | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/storage-driver-cloudinary | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:samlify | AI (dependencies): Legitimate SAML library; expected dependency for an API server with SSO support. | ai | |
| dependencies | unvetted-dep:json2csv | AI (dependencies): Legitimate CSV export library; expected for a data management API. | ai | |
| dependencies | unvetted-dep:@authenio/samlify-node-xmllint | AI (dependencies): Companion validator for samlify; expected in SAML auth context. | ai | |
| provenance | no-provenance | AI (provenance): Established package predating widespread provenance adoption; no other risk signals. | ai | |
| dependencies | unvetted-dep:@wbce-d9/specs | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/utils | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/schema | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@wbce-d9/constants | AI (dependencies): Same-org monorepo sibling; stable pattern across all versions. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Same package — Directus fork, not a typosquat of joi. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Same package — Directus fork, not a typosquat of ajv. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx is used in npm scripts (dev/cli) and config, not directly imported in source — expected pattern. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): pino-pretty is a logger formatter referenced in config, not imported directly — standard pino usage. | ai | |
| phantom-deps | phantom-dep:pino-http-print | AI (phantom-deps): Same as pino-pretty — config-referenced logger transport, not directly imported. | ai | |
| phantom-deps | phantom-dep:@wbce-d9/extensions-sdk | AI (phantom-deps): Same-org monorepo package; phantom-dep heuristic unreliable for dynamically loaded extensions. | ai | |
| phantom-deps | phantom-dep:@wbce-d9/storage-driver-s3 | AI (phantom-deps): Same-org storage driver; loaded dynamically at runtime, not statically imported. | ai | |
| phantom-deps | phantom-dep:@wbce-d9/storage-driver-gcs | AI (phantom-deps): Same-org storage driver; loaded dynamically at runtime. | ai | |
| phantom-deps | phantom-dep:@wbce-d9/storage-driver-azure | AI (phantom-deps): Same-org storage driver; loaded dynamically at runtime. | ai | |
| phantom-deps | phantom-dep:@wbce-d9/storage-driver-local | AI (phantom-deps): Same-org storage driver; loaded dynamically at runtime. | ai | |
| phantom-deps | phantom-dep:@wbce-d9/storage-driver-cloudinary | AI (phantom-deps): Same-org storage driver; loaded dynamically at runtime. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Same package — Directus fork, not a typosquat of pg. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped package @wbce-d9/api is a Directus fork, not a typosquat of hapi; name similarity is coincidental. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 12.5.1 | 94 / 46 | |
| 12.5.0 | 94 / 46 | |
| 12.4.5 | 94 / 46 | |
| 12.4.0 | 94 / 46 | |
| 12.1.0 | 94 / 46 | |
| 12.0.2 | 94 / 46 | |
| 12.0.1 | 94 / 46 | |
| 12.0.0 | 94 / 46 |
v12.5.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v12.5.0
2 findings
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
INFO
Publisher changed: delo06260 → GitHub Actions (on 2026-07-13, now via trusted publisher with provenance)
provenance
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (delo06260) on 2026-07-13, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.