@atmo-dev/contrail
Index AT Protocol records with typed XRPC endpoints. Cloudflare Workers + D1, SvelteKit, Node.js.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@atmo-dev/contrail-record-host | AI (phantom-deps): Same-org monorepo sub-package; referenced in config, not directly imported in this entry point. | ai | |
| phantom-deps | phantom-dep:@atcute/cid | AI (phantom-deps): Referenced in config files for optional adapter use; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@atcute/cbor | AI (phantom-deps): Referenced in config files for optional adapter use; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@atcute/lexicons | AI (phantom-deps): Referenced in config files for optional adapter use; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@atcute/jetstream | AI (phantom-deps): Referenced in config files for optional adapter use; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@atcute/xrpc-server | AI (phantom-deps): Referenced in config files for optional adapter use; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@atcute/identity-resolver | AI (phantom-deps): Referenced in config files for optional adapter use; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@atmo-dev/contrail-authority | AI (phantom-deps): Same-org monorepo sub-package; referenced in config, not directly imported in this entry point. | ai | |
| phantom-deps | phantom-dep:@atcute/identity | AI (phantom-deps): Declared dep used indirectly via re-exports/config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@atcute/atproto | AI (phantom-deps): Declared as a runtime dep and referenced in config; phantom-dep heuristic misfires here. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 0.12.0 | 16 / 8 | |
| 0.11.0 | 16 / 8 | |
| 0.10.0 | 16 / 8 | |
| 0.9.1 | 16 / 8 | |
| 0.9.0 | 16 / 8 | |
| 0.4.0 | 11 / 8 | |
| 0.2.0 | 9 / 7 | |
| 0.1.1 | 8 / 12 | |
| 0.1.0 | 8 / 12 | |
| 0.0.7 | 6 / 12 | |
| 0.0.6 | 6 / 12 | |
| 0.0.5 | 6 / 10 | |
| 0.0.4 | 6 / 11 |
v0.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.11.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.