@zipbul/core
DI container, application bootstrap and module system for Zipbul
6
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
parkrevil
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/src/cluster/application-worker.js | AI (source-diff): Bun-bundled ESM output with --minify-syntax --minify-whitespace; long lines are minified app logic, not obfuscation. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): dotenv is a declared dependency used via config files; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped package @zipbul/core in its own org; not impersonating cors. Levenshtein match is coincidental. | ai | |
| phantom-deps | phantom-dep:@zipbul/baker | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo packages. | ai | |
| phantom-deps | phantom-dep:@zipbul/logger | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo packages. | ai | |
| phantom-deps | phantom-dep:exponential-backoff | AI (phantom-deps): Referenced in config files per finding; stable false positive for this package. | ai |