repo-utils
8
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
doowbjonschlinkert
Keywords
gitgithubreporepo-utilsrepositoryurlutilitiesutilityutils
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:parse-git-config | AI (dependencies): parse-git-config is a legitimate, well-known utility from the same jonschlinkert ecosystem, directly relevant to this package's purpose. | ai | |
| provenance | publisher-changed | AI (provenance): doowb (Brian Woodward) is a known jonschlinkert ecosystem collaborator with 1351 approved packages and 4585 days of history. This is a legitimate maintainer transition, not a compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): doowb is a well-established collaborator in the jonschlinkert/Assemble ecosystem; addition is a legitimate handoff, not a suspicious takeover. | ai | |
| phantom-deps | phantom-dep:omit-empty | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:is-absolute | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:parse-author | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:project-name | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:lazy-cache | AI (phantom-deps): jonschlinkert packages commonly use lazy-cache to lazily require deps; they appear in a cache object rather than top-level imports, causing phantom-dep false positives. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:parse-git-config | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:parse-github-url | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:git-config-path | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:kind-of | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| phantom-deps | phantom-dep:mixin-deep | AI (phantom-deps): Lazy-cache pattern causes phantom-dep false positives for this publisher's packages. Dep is legitimately declared and used indirectly. | ai | |
| provenance | no-provenance | AI (provenance): Established package from a trusted publisher; lack of Sigstore provenance is common and not a security risk for this package. | ai |