gulp-replace
A string replace plugin for gulp
17
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
lazd
Keywords
gulppluginreplace
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @types/node and @types/vinyl are TypeScript type declaration packages with no executable code; their addition reflects TypeScript support being added to this package, not a supply-chain risk. | ai | |
| dependencies | unvetted-dep:@types/node | AI (dependencies): @types/node is a standard TypeScript type package; benign for a plugin with TypeScript support. | ai | |
| dependencies | unvetted-dep:@types/vinyl | AI (dependencies): @types/vinyl provides TypeScript types for gulp's vinyl file objects; expected for a typed gulp plugin. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Type declaration packages are commonly declared without direct imports; this is a known TypeScript ecosystem pattern. | ai | |
| dependencies | unvetted-dep:istextorbinary | AI (dependencies): istextorbinary is a well-known utility for detecting file types; appropriate and expected for a gulp stream plugin. | ai | |
| dependencies | unvetted-dep:replacestream | AI (dependencies): replacestream is the core library this plugin wraps; its use is essential and expected. | ai | |
| phantom-deps | phantom-dep:yargs-parser | AI (phantom-deps): Phantom dependency is a minor hygiene issue; yargs-parser is declared and available, no security impact. | ai | |
| phantom-deps | phantom-dep:@types/vinyl | AI (phantom-deps): Type declaration packages are commonly declared without direct imports; this is a known TypeScript ecosystem pattern. | ai |