eslint-config-fbjs
For the most part, this configuration matches the ESLint configuration we have internally at Facebook.
10
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
zpaocpojerfbbradzacher
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): zpao is a well-known Facebook/Meta engineer with a long, trusted npm history (1523 approved packages). The transition from mjesun to zpao is consistent with a legitimate internal Facebook OSS maintainer handoff. | ai | |
| bogus-package | bogus-package | AI (bogus-package): fb, zpao, and cpojer are well-known Meta/Facebook npm accounts, not spam publishers. False positive from automated spam detection for this legitimate Meta open-source package. | ai | |
| provenance | no-provenance | AI (provenance): Established Meta package published before Sigstore provenance was standard; absence of attestation is not a risk signal for this package. | ai |