use
Easily add plugin support to your node.js application.
13
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jonschlinkertkgriffs
Keywords
use
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): eval() usage is confined to test.js and evaluates the output of the package's own require() wrapper with known string inputs — not a supply-chain risk for this package. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): 'use' is a legitimate, well-established package by jonschlinkert with no intent to impersonate 'qs'; the Levenshtein proximity is coincidental. | ai |