gulp-plugin-prettier — Greenflagged

Gulp plugin to format code with Prettier

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ikatyang

Keywords

gulpgulppluginprettier

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@types/through2	AI (dependencies): @types/through2 is a TypeScript type definition package; benign dev-time artifact listed as runtime dep in this older project.	ai	2026/04/24
dependencies	unvetted-dep:@types/gulp-util	AI (dependencies): @types/gulp-util is a TypeScript type definition package; benign dev-time artifact listed as runtime dep in this older project.	ai	2026/04/24
phantom-deps	phantom-dep:@types/through2	AI (phantom-deps): TypeScript @types packages are not directly imported at runtime; phantom-dep finding is expected for this package type.	ai	2026/04/24
phantom-deps	phantom-dep:@types/gulp-util	AI (phantom-deps): TypeScript @types packages are not directly imported at runtime; phantom-dep finding is expected for this package type.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Package is 3197 days old, predating Sigstore provenance; absence is expected and not a security concern for this established package.	ai	2026/04/24