findup-sync
Find the first file matching a given pattern in the current directory or the nearest ancestor directory.
3
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sttkphatedcowboytkellenjonschlinkert
Keywords
filefindfind-upfindupglobmatchpatternresolvesearch
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate transfer from jonschlinkert to phated (Blaine Bublitz), a core Gulp team member listed as contributor. Package moved to gulpjs org. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (contra, phated, sttk) are all well-known Gulp core team members. Legitimate org transfer. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy explained by project transfer to Gulp team; phated is a highly trusted publisher with 15K+ approved versions. | ai | |
| dependencies | unvetted-dep:resolve-dir | AI (dependencies): resolve-dir is a legitimate Gulp ecosystem dependency; its use in findup-sync is expected and stable across versions. | ai | |
| provenance | no-provenance | AI (provenance): Gulp team packages historically lack Sigstore provenance; this is a known gap, not a security risk for this publisher. | ai |