← Home

@zintrust/core

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

diadal

Keywords

frameworktypescriptbackendormquery-builderrest-apireactreact-apivuevue-apisymfonylaravel

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:hex-decode AI (semgrep): Hex decode used for AES-256-GCM IV and auth tag parsing — legitimate crypto pattern. ai
install-scripts install-script:postinstall AI (install-scripts): Postinstall is a no-op process.exit(0); stable false positive for this package. ai
semgrep semgrep:silent-process-exec AI (semgrep): Detached spawn in VersionChecker is a self-restart pattern for CLI version upgrades, not a reverse shell. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same VersionChecker self-restart context; benign for this package. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get inside a Proxy get trap is idiomatic JS; not obfuscation. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding JWT/auth token bodies in ServiceAuthMiddleware is standard auth middleware practice. ai
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped package @zintrust/core is a framework, not a typosquat of cors; name collision is coincidental. ai
phantom-deps phantom-dep:@zintrust/workers AI (phantom-deps): Same-org sibling package loaded by framework convention. ai
phantom-deps phantom-dep:@cloudflare/containers AI (phantom-deps): Framework-scoped Cloudflare package loaded by convention, not direct import. ai
phantom-deps phantom-dep:bullmq AI (phantom-deps): bullmq is a declared dependency used via config/convention in this framework. ai
semgrep semgrep:env-spread AI (semgrep): env-spread passes process.env to a child process spawn — standard CLI framework pattern, not exfiltration. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): All raw-IP references are localhost (127.0.0.1) log messages, not external network calls. ai
semgrep semgrep:env-bulk-read AI (semgrep): Reads process.env to build worker dev-vars config file — expected framework behavior. ai

Versions (showing 100 of 249)

Version Deps Published
0.7.9 10 / 0
0.7.8 10 / 0
0.7.7 10 / 0
0.7.3 10 / 0
0.7.2 10 / 0
0.7.0 9 / 0
0.5.9 9 / 0
0.5.8 9 / 0
0.5.7 9 / 0
0.5.5 9 / 0
0.5.2 9 / 0
0.5.1 9 / 0
0.5.0 9 / 0
0.4.101 9 / 0
0.4.99 9 / 0
0.4.98 9 / 0
0.4.96 9 / 0
0.4.95 9 / 0
0.4.94 9 / 0
0.4.93 9 / 0
0.4.92 9 / 0
0.4.91 9 / 0
0.4.89 9 / 0
0.4.88 9 / 0
0.4.87 9 / 0
0.4.86 9 / 0
0.4.84 9 / 0
0.4.83 9 / 0
0.4.81 9 / 0
0.4.80 9 / 0
0.4.79 9 / 0
0.4.77 9 / 0
0.4.76 9 / 0
0.4.75 9 / 0
0.4.74 9 / 0
0.4.72 9 / 0
0.4.71 9 / 0
0.4.70 9 / 0
0.4.68 9 / 0
0.4.67 9 / 0
0.4.66 9 / 0
0.4.65 9 / 0
0.4.64 9 / 0
0.4.63 9 / 0
0.4.62 9 / 0
0.4.61 10 / 0
0.4.60 10 / 0
0.4.59 10 / 0
0.4.58 10 / 0
0.4.57 10 / 0
0.4.56 10 / 0
0.4.55 8 / 0
0.4.54 8 / 0
0.4.53 8 / 0
0.4.52 8 / 0
0.4.51 8 / 0
0.4.50 10 / 0
0.4.49 10 / 0
0.4.43 10 / 0
0.4.42 10 / 0
0.4.41 10 / 0
0.4.40 10 / 0
0.4.39 10 / 0
0.4.38 10 / 0
0.4.36 10 / 0
0.4.34 10 / 0
0.4.33 10 / 0
0.4.32 10 / 0
0.4.31 10 / 0
0.4.30 10 / 0
0.4.29 10 / 0
0.4.28 10 / 0
0.4.27 10 / 0
0.4.26 10 / 0
0.4.24 10 / 0
0.4.22 10 / 0
0.4.21 10 / 0
0.4.20 10 / 0
0.4.19 10 / 0
0.4.18 10 / 0
0.4.17 10 / 35
0.4.16 10 / 0
0.4.15 10 / 0
0.4.14 10 / 0
0.4.13 10 / 0
0.4.12 10 / 0
0.4.11 10 / 0
0.4.10 10 / 0
0.4.9 10 / 0
0.4.8 10 / 0
0.4.7 10 / 0
0.4.6 10 / 0
0.4.5 10 / 0
0.4.4 10 / 0
0.4.3 10 / 0
0.4.2 10 / 0
0.4.1 10 / 0
0.4.0 10 / 0
0.1.54 10 / 0
0.1.53 10 / 0
Showing 100 of 249 Next page →

v0.4.28

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.