← Home

@zenithbuild/core

npm Repository Homepage

Deterministic utility substrate for the Zenith framework

60
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

judahsullivan

Keywords

zenithcoreframework

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@types/acorn AI (phantom-deps): Type-only package; not directly imported at runtime by convention. ai
provenance publisher-changed AI (provenance): Transition from human publisher to GitHub Actions CI/CD is confirmed by SLSA provenance attestation; legitimate automation handoff. ai
phantom-deps phantom-dep:@types/marked AI (phantom-deps): @types packages are type-only; loaded by TypeScript, not imported at runtime. ai
semgrep semgrep:env-spread AI (semgrep): Standard pattern passing env to child_process.spawn in a build tool compiler. ai
dependencies unvetted-dep:@zenithbuild/compiler AI (dependencies): Same-org scoped package (@zenithbuild); consistent versioning pattern across the monorepo, no independent risk signal. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() is standard Proxy trap pattern in a reactivity/state system; not obfuscation. ai
semgrep semgrep:new-function-constructor AI (semgrep): Used only for compile-time syntax validation in the template compiler; code is never executed at runtime. ai
phantom-deps phantom-dep:@types/parse5 AI (phantom-deps): @types/parse5 is a type declaration package for parse5 which is a direct dependency; phantom-dep false positive. ai
phantom-deps phantom-dep:@zenithbuild/cli AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic unreliable for peer/optional deps in monorepos. ai
phantom-deps phantom-dep:@zenithbuild/compiler AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic unreliable for peer/optional deps in monorepos. ai
phantom-deps phantom-dep:@zenithbuild/runtime AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic unreliable for peer/optional deps in monorepos. ai
phantom-deps phantom-dep:@zenithbuild/bundler AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic unreliable for peer/optional deps in monorepos. ai
phantom-deps phantom-dep:@zenithbuild/router AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic unreliable for peer/optional deps in monorepos. ai
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped @zenithbuild/core is a framework core package, not impersonating the unscoped 'cors' package; name collision is incidental. ai

Versions (showing 60 of 60)

Version Deps Published
1.3.21 4 / 3
1.3.20 4 / 3
1.3.19 4 / 3
1.3.18 4 / 3
1.3.17 4 / 3
1.3.14 4 / 3
1.3.13 0 / 3
1.3.11 4 / 3
1.3.7 4 / 3
1.3.6 4 / 3
1.3.5 4 / 3
1.3.4 3 / 3
1.3.3 3 / 3
1.3.2 3 / 3
1.3.1 4 / 3
1.3.0 3 / 3
1.2.15 3 / 3
1.2.14 3 / 3
1.2.13 3 / 3
1.2.12 3 / 3
1.2.11 3 / 3
1.2.10 3 / 3
1.2.2 9 / 3
1.2.1 9 / 3
1.2.0 9 / 3
1.1.0 9 / 3
0.7.11 5 / 4
0.7.10 5 / 4
0.7.9 5 / 4
0.7.7 5 / 4
0.7.5 5 / 4
0.7.4 5 / 4
0.7.3 5 / 4
0.7.2 5 / 4
0.7.1 5 / 4
0.7.0 5 / 4
0.6.17 5 / 4
0.6.13 5 / 4
0.6.12 5 / 4
0.6.11 5 / 4
0.6.10 5 / 4
0.6.9 5 / 4
0.6.7 5 / 4
0.6.6 5 / 2
0.6.5 5 / 2
0.6.4 5 / 2
0.6.3 9 / 3
0.6.2 9 / 3
0.6.1 8 / 3
0.6.0 8 / 3
0.5.0 6 / 3
0.4.7 4 / 3
0.4.6 4 / 3
0.4.5 4 / 3
0.4.4 4 / 3
0.4.2 4 / 3
0.4.1 4 / 3
0.3.3 2 / 3
0.3.1 2 / 3
0.3.0 2 / 3