@stripe/extensibility-eslint-plugin
ESLint plugin and flat config for Stripe Apps development. Includes security checks, code quality rules, and FormSpec type-safety rules.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/configs/billing.invoice_collection_options.cjs | AI (source-diff): Standard esbuild/tsup bundle inlining eslint plugin deps; long lines are bundler output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/configs/billing.invoice_collection_options.cjs | AI (source-diff): No actual network calls; bundler boilerplate triggers false positive on this ESLint config bundle. | ai | |
| source-diff | obfuscated-file:dist/configs/billing.invoice_collection_options.js | AI (source-diff): Same tsup ESM bundle; long lines are bundler output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/configs/billing.invoice_collection_options.js | AI (source-diff): No actual network calls; bundler boilerplate triggers false positive on this ESLint config bundle. | ai | |
| phantom-deps | phantom-dep:@formspec/eslint-plugin | AI (phantom-deps): Same ESLint config-object reference pattern; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-no-secrets | AI (phantom-deps): Same ESLint config-object reference pattern; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-security | AI (phantom-deps): ESLint plugin deps are referenced in config objects, not direct imports; stable FP for this package. | ai |
v1.0.1
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.