ui5-tooling-modules
UI5 CLI extensions to load and convert node modules as UI5 AMD-like modules
4
Versions
Apache-2.0
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
ui5-community-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Well-known deps used directly by the reviewed postinstall logic. | ai | |
| source-diff | net-exec-file:lib/polyfills.js | AI (source-diff): Bundled polyfill-node shim providing browser XHR/fetch polyfills, not a loader/dropper. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size jump from bundling rollup-plugin-polyfill-node's polyfills, not injected payload. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): Handlebars is a well-known templating library; stable dependency for this package across versions. | ai | |
| phantom-deps | phantom-dep:@rollup/pluginutils | AI (phantom-deps): @rollup/pluginutils is a listed runtime dependency in package.json; phantom-dep is a false positive here. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Long-standing postinstall for UI5 tooling setup; SLSA provenance confirms CI/CD origin. | ai | |
| bogus-package | bogus-package | AI (bogus-package): ui5-community-bot is a known automation publisher for the ui5-ecosystem-showcase monorepo; templated naming is expected. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require on pkgJsonPath is a package.json loader pattern, not arbitrary code execution. | ai |
Versions (showing 4 of 104)
| Version | Deps | Published |
|---|---|---|
| 3.5.3 | 16 / 1 | |
| 3.5.2 | 16 / 1 | |
| 3.5.1 | 16 / 1 | |
| 3.5.0 | 16 / 1 |
v3.5.3
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.5.2
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.5.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.5.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.