← Home

@sveltejs/acorn-typescript

npm Repository Homepage

Acorn plugin that parses TypeScript

10
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

rich_harrissvelte-adminconduitry

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata url-dep:test262 AI (npm-metadata): DevDep pointing to official TC39 test262 repo with SHA pin; standard for JS parser projects. ai
maintainer-change maintainer-removed AI (maintainer-change): Normal Svelte team roster change; package has SLSA provenance and is published via GitHub Actions. ai

Versions (showing 10 of 10)

Version Deps Published
1.0.10 0 / 11
1.0.9 0 / 11
1.0.8 0 / 11
1.0.7 0 / 11
1.0.6 0 / 11
1.0.5 0 / 11
1.0.4 0 / 11
1.0.3 0 / 11
1.0.2 0 / 10
1.0.1 0 / 10

v1.0.10

2 findings
HIGH SHA-pinned github dependency (devDependencies): test262 npm-metadata

Dependency 'test262' in `devDependencies` points to 'git+https://github.com/tc39/test262.git#88ebb1e3755198cd08757bca1698effbbf360345' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.