@types/minipass — Greenflagged

Stub TypeScript definitions entry for minipass, which provides its own types definitions

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

types

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	dormant-publish	AI (publish-pattern): Stub @types redirect package; dormancy is expected — it only needs updating when upstream bundles its own types, a one-time event. Publisher has 10k+ approvals and 0 rejections.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): Adding minipass as a runtime dep is the canonical stub @types pattern — it forwards type resolution to the upstream package. Not an attack vector here.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): Stub/redirect @types packages are intentionally tiny with no code, no README instructions, and no keywords. All signals are expected for this package type.	ai	2026/04/23
phantom-deps	phantom-dep:minipass	AI (phantom-deps): Stub package declares minipass as a dep for type resolution forwarding, not for direct import. Phantom-dep finding is a stable false positive for this package.	ai	2026/04/23