ts-pantry
A library & CLI for managing packages
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/src/index.js | AI (source-diff): Bundled esbuild/bun chunk output, not true obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are same-author stacksjs ecosystem packages, consistent with maintainer's other projects. | ai | |
| provenance | publisher-changed | AI (provenance): Change reflects CI/CD attestation adoption, an improvement. | ai | |
| source-diff | obfuscated-file:dist/generated-package-names.d.ts | AI (source-diff): Generated .d.ts type union file, not obfuscated executable code. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Env passthrough for spawning package build/install subprocesses, dual-use CLI pattern. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Growth from bundling generated package metadata/database, matches package purpose. | ai | |
| source-diff | obfuscated-file:dist/packages/modalcom.d.ts | AI (source-diff): Long lines in .d.ts files are from large version arrays in generated type declarations, not obfuscation. Stable pattern for this package. | ai | |
| dependencies | unvetted-dep:ts-web-scraper | AI (dependencies): Phantom dep finding confirms it's declared but not directly imported; low actual risk. | ai | |
| dependencies | unvetted-dep:@stacksjs/ts-cloud | AI (dependencies): Phantom dep finding confirms it's declared but not directly imported; low actual risk. | ai | |
| phantom-deps | phantom-dep:bunfig | AI (phantom-deps): Referenced in config files only, not directly imported; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@stacksjs/ts-cloud | AI (phantom-deps): Referenced in config files only, not directly imported; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:ts-web-scraper | AI (phantom-deps): Referenced in config files only, not directly imported; stable false positive for this package. | ai |
Versions (showing 60 of 60)
| Version | Deps | Published |
|---|---|---|
| 0.10.55 | 3 / 2 | |
| 0.10.52 | 3 / 2 | |
| 0.10.51 | 3 / 2 | |
| 0.10.50 | 3 / 2 | |
| 0.10.48 | 3 / 2 | |
| 0.10.47 | 3 / 2 | |
| 0.10.43 | 3 / 2 | |
| 0.10.41 | 3 / 2 | |
| 0.10.40 | 3 / 2 | |
| 0.10.36 | 3 / 2 | |
| 0.10.35 | 3 / 2 | |
| 0.10.34 | 3 / 2 | |
| 0.10.33 | 3 / 2 | |
| 0.10.30 | 3 / 2 | |
| 0.10.28 | 3 / 2 | |
| 0.10.25 | 3 / 2 | |
| 0.10.24 | 3 / 2 | |
| 0.10.23 | 3 / 2 | |
| 0.10.20 | 3 / 2 | |
| 0.10.17 | 3 / 2 | |
| 0.10.16 | 3 / 2 | |
| 0.10.15 | 3 / 2 | |
| 0.10.14 | 3 / 2 | |
| 0.10.13 | 3 / 2 | |
| 0.10.12 | 3 / 2 | |
| 0.10.11 | 3 / 2 | |
| 0.9.37 | 3 / 1 | |
| 0.9.36 | 3 / 1 | |
| 0.9.35 | 3 / 1 | |
| 0.9.31 | 3 / 1 | |
| 0.9.30 | 3 / 1 | |
| 0.9.29 | 3 / 1 | |
| 0.9.28 | 3 / 1 | |
| 0.9.27 | 3 / 1 | |
| 0.9.26 | 3 / 1 | |
| 0.9.25 | 3 / 1 | |
| 0.9.24 | 3 / 1 | |
| 0.9.21 | 3 / 1 | |
| 0.9.20 | 3 / 1 | |
| 0.9.19 | 3 / 1 | |
| 0.9.18 | 3 / 1 | |
| 0.9.16 | 3 / 1 | |
| 0.9.13 | 3 / 1 | |
| 0.9.7 | 3 / 1 | |
| 0.9.4 | 3 / 1 | |
| 0.9.2 | 3 / 1 | |
| 0.9.1 | 3 / 1 | |
| 0.9.0 | 3 / 1 | |
| 0.8.18 | 3 / 1 | |
| 0.8.17 | 3 / 1 | |
| 0.8.16 | 3 / 1 | |
| 0.8.15 | 3 / 1 | |
| 0.8.14 | 3 / 1 | |
| 0.8.13 | 3 / 1 | |
| 0.8.11 | 3 / 1 | |
| 0.8.4 | 3 / 1 | |
| 0.7.5 | 0 / 3 | |
| 0.7.4 | 0 / 3 | |
| 0.7.2 | 0 / 3 | |
| 0.7.1 | 0 / 3 |
v0.10.55
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.52
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.51
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.50
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.48
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.47
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.43
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.41
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.40
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.36
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.35
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.34
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.33
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.30
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.28
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.25
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.24
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.23
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.20
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.17
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.16
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.15
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.19
3 findingsThis version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.18
4 findingsThis version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.16
4 findingsThis version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.13
4 findingsThis version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.7
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.9.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.18
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.17
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 119 | const libPaths = getLibraryPaths(packages) 120 | > 121 | const env = { ...process.env } as Record<string, string> 122 | 123 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.16
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 117 | const libPaths = getLibraryPaths(packages) 118 | > 119 | const env = { ...process.env } as Record<string, string> 120 | 121 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.15
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 117 | const libPaths = getLibraryPaths(packages) 118 | > 119 | const env = { ...process.env } as Record<string, string> 120 | 121 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.14
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 117 | const libPaths = getLibraryPaths(packages) 118 | > 119 | const env = { ...process.env } as Record<string, string> 120 | 121 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.13
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 117 | const libPaths = getLibraryPaths(packages) 118 | > 119 | const env = { ...process.env } as Record<string, string> 120 | 121 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.11
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 117 | const libPaths = getLibraryPaths(packages) 118 | > 119 | const env = { ...process.env } as Record<string, string> 120 | 121 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Spreading entire process.env into an object — may capture all secrets 117 | const libPaths = getLibraryPaths(packages) 118 | > 119 | const env = { ...process.env } as Record<string, string> 120 | 121 | if (binPaths.length > 0) {
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.