← Home

eslint-plugin-pkg-json

npm Repository Homepage

ESLint plugin for linting package.json file

20
Versions
MIT
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures No source commit

Maintainers

zanminkian

Keywords

eslintconfigeslint-configeslint-pluginpackage-jsonpackagejsonpackagejsonnode

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/rules/compatible-engines-node-version.js AI (source-diff): File is readable compiled JS output, not obfuscated; long lines are from bundled/minified imports, not malicious code. ai
publish-pattern new-deps-added AI (publish-pattern): semver is a well-known, widely-trusted package added for a clearly scoped version-comparison feature. ai
provenance publisher-changed AI (provenance): Transition from manual publish to GitHub Actions CI/CD; SLSA attestation confirms automated pipeline from the same repo. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy followed by CI/CD-automated release with SLSA provenance; consistent with a tooling migration rather than account takeover. ai

Versions (showing 20 of 20)

Version Deps Published
0.6.1 2 / 5
0.6.0 2 / 5
0.5.0 2 / 4
0.4.10 2 / 4
0.4.9 2 / 4
0.4.8 2 / 4
0.4.7 2 / 4
0.4.6 2 / 4
0.4.5 2 / 4
0.4.4 2 / 4
0.4.3 2 / 4
0.4.2 2 / 4
0.4.1 2 / 4
0.4.0 1 / 3
0.3.3 0 / 3
0.3.2 0 / 3
0.1.3 0 / 6
0.1.2 0 / 6
0.1.1 0 / 6
0.1.0 0 / 6

v0.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.