fallow
Codebase intelligence for TypeScript and JavaScript. Finds unused code, duplication, circular dependencies, complexity hotspots, and architecture drift. Optional runtime intelligence layer (Fallow Runtime) adds production execution evidence. Rust-native,
63
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
bartwaardenburg
Keywords
code-intelligencecode-qualitypr-riskstatic-analysiscode-duplicationcircular-dependenciesunused-codecomplexityarchitecturetypescriptjavascriptanalyzerlintlspmcpagent-skillstanstack-intent
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is in test harness setting NODE_PATH for spawned launcher; no exfil destination. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires in test files using a constant path variable; stable false positive for this package. | ai | |
| provenance | missing-githead | AI (provenance): SLSA provenance attestation present; missing gitHead is a minor metadata gap, not a security signal. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is a new .d.ts type declaration file (80KB), not executable payload. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Standard prebuilt-binary selection for Rust-native CLI; platform packages are scoped under @fallow-cli/* as optional deps. | ai |
Versions (showing 63 of 163)
| Version | Deps | Published |
|---|---|---|
| 2.27.2 | 1 / 0 | |
| 2.27.1 | 1 / 0 | |
| 2.27.0 | 1 / 0 | |
| 2.26.1 | 1 / 0 | |
| 2.26.0 | 1 / 0 | |
| 2.25.1 | 1 / 0 | |
| 2.24.0 | 1 / 0 | |
| 2.23.1 | 1 / 0 | |
| 2.23.0 | 1 / 0 | |
| 2.22.4 | 1 / 0 | |
| 2.22.3 | 1 / 0 | |
| 2.22.0 | 1 / 0 | |
| 2.20.0 | 1 / 0 | |
| 2.19.3 | 1 / 0 | |
| 2.19.0 | 1 / 0 | |
| 2.18.3 | 1 / 0 | |
| 2.18.0 | 1 / 0 | |
| 2.17.1 | 1 / 0 | |
| 2.17.0 | 1 / 0 | |
| 2.16.0 | 1 / 0 | |
| 2.14.1 | 1 / 0 | |
| 2.14.0 | 1 / 0 | |
| 2.13.4 | 1 / 0 | |
| 2.13.3 | 1 / 0 | |
| 2.13.2 | 1 / 0 | |
| 2.13.0 | 1 / 0 | |
| 2.12.1 | 1 / 0 | |
| 2.12.0 | 1 / 0 | |
| 2.11.0 | 1 / 0 | |
| 2.10.0 | 1 / 0 | |
| 2.9.1 | 1 / 0 | |
| 2.9.0 | 1 / 0 | |
| 2.8.0 | 1 / 0 | |
| 2.7.3 | 1 / 0 | |
| 2.7.2 | 1 / 0 | |
| 2.7.1 | 1 / 0 | |
| 2.6.0 | 1 / 0 | |
| 2.5.4 | 1 / 0 | |
| 2.5.3 | 1 / 0 | |
| 2.5.1 | 1 / 0 | |
| 2.5.0 | 1 / 0 | |
| 2.4.0 | 1 / 0 | |
| 2.3.0 | 1 / 0 | |
| 2.2.3 | 1 / 0 | |
| 2.2.1 | 1 / 0 | |
| 2.1.0 | 1 / 0 | |
| 2.0.1 | 1 / 0 | |
| 2.0.0 | 1 / 0 | |
| 1.9.0 | 1 / 0 | |
| 1.8.1 | 1 / 0 | |
| 1.8.0 | 1 / 0 | |
| 1.7.0 | 1 / 0 | |
| 1.6.0 | 1 / 0 | |
| 1.4.0 | 1 / 0 | |
| 1.3.1 | 1 / 0 | |
| 1.3.0 | 1 / 0 | |
| 1.2.0 | 1 / 0 | |
| 1.1.0 | 1 / 0 | |
| 1.0.4 | 1 / 0 | |
| 1.0.3 | 1 / 0 | |
| 0.1.6 | 1 / 0 | |
| 0.1.5 | 1 / 0 | |
| 0.1.0 | 0 / 0 |
v2.0.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.