← Home

bolt

npm Repository Homepage

> Super-powered JavaScript project management

51
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

thejameskylelbatchelorpadmaia

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): New deps (chunkd, ci-parallel-vars, detect-newline) are small, well-known utility packages appropriate for bolt's monorepo tooling use case. No malicious signals. ai
provenance no-provenance AI (provenance): bolt is a mature package (5328 days old) predating Sigstore provenance; absence of attestation is expected and not a meaningful risk signal for this package. ai
typosquat typosquat.levenshtein:got AI (typosquat): bolt is a well-established monorepo/workspace tool (boltpkg) with no relation to 'got'. Levenshtein proximity is coincidental; no impersonation intent. ai
npm-metadata url-dep:meow AI (npm-metadata): Pinned to a specific commit hash of meow by the legitimate author. Deterministic and intentional; acceptable for this established package. ai
provenance publisher-changed AI (provenance): thejameskyle is the listed author in package.json and has a strong publishing track record; the 2019 transition from lbatchelor back to the original author is a legitimate handoff. ai
phantom-deps phantom-dep:yarn AI (phantom-deps): bolt wraps yarn as a subprocess; yarn is a legitimate runtime dep referenced in config/tooling, not directly imported in JS. Stable pattern for this package. ai
bogus-package bogus-package AI (bogus-package): thejameskyle (James Kyle) is a well-known OSS developer (Babel, Flow). The spam flag is a false positive; bolt is a legitimate, established monorepo tool with 79 approved versions. ai
phantom-deps phantom-dep:find-up AI (phantom-deps): find-up is a legitimate runtime dependency used indirectly; phantom-dep finding is a false positive for this package's architecture. ai
phantom-deps phantom-dep:is-glob AI (phantom-deps): is-glob is a legitimate runtime dependency used indirectly; phantom-dep finding is a false positive for this package's architecture. ai
phantom-deps phantom-dep:read-pkg AI (phantom-deps): read-pkg is a legitimate runtime dependency used indirectly; phantom-dep finding is a false positive for this package's architecture. ai
dependencies unvetted-dep:yarn AI (dependencies): yarn is a well-known package manager; bolt intentionally depends on it as it wraps yarn workspaces functionality. ai

Versions (showing 51 of 66)

View all versions
Version Deps Published
0.24.10 33 / 16
0.24.9 33 / 16
0.24.8 33 / 16
0.24.7 33 / 16
0.24.6 33 / 16
0.24.5 33 / 16
0.24.4 33 / 16
0.24.3 33 / 16
0.24.2 33 / 16
0.24.1 33 / 16
0.24.0 33 / 16
0.23.6 33 / 16
0.23.5 33 / 16
0.23.4 33 / 16
0.23.3 33 / 16
0.23.2 33 / 16
0.23.1 33 / 16
0.22.6 32 / 16
0.22.5 32 / 16
0.22.4 32 / 16
0.22.3 30 / 16
0.22.2 30 / 16
0.22.1 30 / 16
0.22.0 30 / 16
0.21.2 30 / 16
0.21.1 30 / 16
0.21.0 30 / 16
0.20.7 30 / 16
0.20.6 30 / 16
0.20.5 30 / 16
0.20.4 30 / 16
0.20.3 30 / 16
0.20.2 30 / 16
0.20.1 30 / 16
0.20.0 30 / 15
0.19.3 30 / 15
0.19.2 29 / 15
0.19.1 29 / 15
0.19.0 29 / 15
0.18.4 29 / 15
0.18.3 27 / 15
0.18.2 27 / 15
0.18.1 27 / 15
0.18.0 27 / 15
0.17.7 24 / 15
0.17.6 22 / 15
0.17.5 22 / 15
0.17.4 22 / 15
0.17.2 22 / 15
0.17.1 22 / 15
0.17.0 22 / 15