adminforth
17
Versions
—
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
vanbroshmultifoxvkhamanlbp22storozhokrmalenkodominic-de-cocovitasikaakopyan12345noone7135yaroslav8765
Keywords
adminforthagentai-agentskill.mdtool-callingagent-nativeai-nativeai-firstadmin-panelbackofficecrudnodejstypescriptvuetailwind
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:bson | AI (phantom-deps): bson is a declared dependency used for ObjectId handling; phantom-dep heuristic false positive. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): High-velocity project with 2022 registry versions; rapid publishes are normal for this package. | ai | |
| dependencies | unvetted-dep:private-ip | AI (dependencies): Used for IP validation in admin panel; stable dependency across versions. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): Legitimate templating dependency used by this admin framework across many versions. | ai | |
| phantom-deps | phantom-dep:sanitize-html | AI (phantom-deps): sanitize-html is listed as a direct dependency in package.json; phantom-dep is a false positive here. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established framework with 1944 versions and 6.1k weekly downloads; bogus-package signals are false positives here. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Used in CLI callTsProxy.js to forward env to child process with augmented PATH — standard and benign pattern for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): multer and sanitize-html are well-established packages fitting the admin panel's file upload and HTML sanitization use cases. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used only to run pnpm install in postinstall; benign for this package. | ai | |
| phantom-deps | phantom-dep:@faker-js/faker | AI (phantom-deps): Referenced in config/demo files; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/express | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): pino-pretty is a logging formatter loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:esm | AI (phantom-deps): esm is a runtime loader referenced in config; phantom-dep heuristic false positive. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync runs fixed pnpm install command; no user-controlled input, stable pattern. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs pnpm install on bundled SPA; documented pattern for this admin panel framework. | ai |