@workflow/core
Core runtime and engine for Workflow SDK
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/step-hydration-cache.js | AI (source-diff): Readable commented TS build output, not obfuscation; official Vercel SDK dist. | ai | |
| source-diff | obfuscated-file:dist/vm/script-cache.js | AI (source-diff): Readable commented TS build output, not obfuscation; official Vercel SDK dist. | ai | |
| source-diff | obfuscated-file:dist/runtime/get-port-lazy.js | AI (source-diff): Readable commented TS build output, not obfuscation; official Vercel SDK dist. | ai | |
| source-diff | obfuscated-file:dist/runtime/wait-until.js | AI (source-diff): Sample shows clear readable source; long-line heuristic false positive on this dist file. | ai | |
| dependencies | unvetted-dep:@types/ms | AI (dependencies): @types/ms is a stable DefinitelyTyped type-definition package; no runtime risk for this package. | ai | |
| phantom-deps | phantom-dep:@types/ms | AI (phantom-deps): Type declaration dep; loaded by TypeScript convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/credential-provider-web-identity | AI (phantom-deps): AWS SDK sub-package loaded by convention via SDK resolution. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Vercel monorepo package; sparse README/keywords is normal for internal SDK packages. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @workflow/core is not a typosquat of 'cors'; completely different namespace and purpose. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 4.6.2 | 19 / 8 | |
| 4.6.1 | 19 / 8 | |
| 4.6.0 | 19 / 8 | |
| 4.5.0 | 19 / 8 | |
| 4.4.0 | 19 / 8 | |
| 4.3.1 | 19 / 8 | |
| 4.3.0 | 19 / 8 | |
| 4.2.6 | 19 / 8 | |
| 4.2.5 | 19 / 8 | |
| 4.2.4 | 19 / 8 | |
| 4.2.3 | 19 / 8 | |
| 4.2.2 | 19 / 8 | |
| 4.2.1 | 19 / 8 | |
| 4.2.0 | 19 / 8 |
v4.6.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.6.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.