@graphql-toolkit/graphql-tag-pluck
Pluck graphql-tag template literals
14
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
ardatandotansimhaurigo
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): vue-template-compiler is a legitimate optional dependency for Vue SFC support in a GraphQL tag plucking tool; not a malicious addition. | ai | |
| provenance | publisher-changed | AI (provenance): ardatan and dotansimha are both core graphql-toolkit maintainers; this is a documented team transition within the same project, not a suspicious account takeover. | ai | |
| dependencies | unvetted-dep:vue-template-compiler | AI (dependencies): vue-template-compiler is an optional dep used for Vue SFC parsing — legitimate and contextually appropriate for a GraphQL tag pluck utility. | ai | |
| provenance | no-provenance | AI (provenance): Package is 2343 days old with 593 versions; provenance attestation did not exist when this package was established. Not a meaningful risk signal for this package. | ai |