periscopic
periscopic
18
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
rich_harris
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | slsa-provenance | AI (provenance): Package publishes via GitHub Actions with SLSA provenance; this is the expected pattern for this package going forward. | ai | |
| provenance | publisher-changed | AI (provenance): rich_harris migrated publishing to GitHub Actions CI; repo URL still points to Rich-Harris/periscopic. Legitimate maintainer-initiated CI migration. | ai | |
| provenance | missing-githead | AI (provenance): gitHead is absent because publishing moved to GitHub Actions/changesets CI workflow, which doesn't inject gitHead. SLSA provenance attestation provides stronger commit linkage. | ai | |
| phantom-deps | phantom-dep:@types/estree | AI (phantom-deps): @types/estree is a type-only dependency used for ESTree AST typings; not imported at runtime. Standard pattern for AST utility packages. | ai |