@yamf/core
A lightweight, zero-dependency microservices framework for Node.js with built-in service discovery, api gateway, pub/sub messaging, HTTP routing, and load balancing.
8
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
yamf
Keywords
microservicesapi gatewayservice discoverypub/subHTTP routingload balancingzero-dependency
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): Self-flagged in a TODO comment as a known risk in a CLI shorthand parser; not in install path. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Framework with child-process utilities; expected for a microservices orchestration tool. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding used for deploy bundle signature verification, a legitimate cryptographic use case. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @yamf/core is a scoped microservices framework package, not a typosquat of cors. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): env-config.js is an explicit environment configuration loader; bulk process.env read is its documented purpose. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is part of AES-256-GCM IV/authTag handling in the crypto module — standard cryptographic pattern. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IPs are localhost/127.0.0.1 references in service-discovery registry diagnostic comments, not exfiltration endpoints. | ai |