sails-generate-frontend

Default generator for frontend code files in new Sails projects. Creates the default contents of the `assets/` folder when you run `sails new` on the command-line. Also creates a subset of the boilerplate Grunt task files (in `tasks/`); specifically, the

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

balderdashysgress454mikermcneil

Keywords

frontendgeneratorsailsgenerateplugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:templates/assets/js/dependencies/sails.io.js	AI (source-diff): Official Socket.IO 0.9.16 + sails.io client, bundled as scaffold template asset. Network+exec pattern is inherent to the socket client library; not malware.	ai	2026/04/24
source-diff	net-exec-file:templates/assets/js/dependencies/angular.min.js	AI (source-diff): Official AngularJS v1.2.14 minified build bundled as a scaffold template asset. Network+exec pattern is inherent to any frontend framework; not malware.	ai	2026/04/24
source-diff	obfuscated-file:templates/assets/js/dependencies/sails.io.js	AI (source-diff): Minified Socket.IO production build; long lines are expected minification artifact, not obfuscation for malicious purposes.	ai	2026/04/24
semgrep	semgrep:eval-usage	AI (semgrep): eval() is in Socket.IO 0.9.16's JSON parser fallback — a well-known, benign pattern in this library. File is a static template asset, not executed at install time.	ai	2026/04/24
source-diff	net-exec-file:templates/assets/js/socket.io.js	AI (source-diff): This is the canonical Socket.IO 0.9.16 client library bundled as a scaffold template asset by the official Sails.js org (balderdashy). Not malicious.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): mikermcneil is the Sails.js framework founder (balderdashy org) with 1494 approved packages. The 2016 transition from sgress454 is a well-known legitimate maintainer consolidation, not a takeover.	ai	2026/04/24
phantom-deps	phantom-dep:sails-generate-sails.io.js	AI (phantom-deps): sails-generate-sails.io.js is a generator plugin referenced by name in config rather than directly imported — standard pattern for Sails generator packages.	ai	2026/04/24

Versions (showing 29 of 29)

Version	Deps	Published
0.12.3	3 / 0	2016-10-05
0.12.2	3 / 0	2016-07-08
0.12.1	3 / 5	2016-02-05
0.12.0	3 / 5	2016-01-19
0.11.7	3 / 5	2016-01-19
0.11.6	3 / 5	2015-10-16
0.11.5	3 / 5	2015-05-18
0.11.4	3 / 5	2015-03-05
0.11.2	3 / 5	2014-12-19
0.11.1	3 / 5	2014-12-19
0.11.0	3 / 5	2014-12-17
0.10.20	2 / 5	2014-07-26
0.10.19	2 / 5	2014-07-26
0.10.18	2 / 5	2014-06-09
0.10.17	2 / 5	2014-05-05
0.10.16	2 / 5	2014-04-28
0.10.15	2 / 5	2014-04-28
0.10.14	2 / 5	2014-04-28
0.10.13	2 / 5	2014-04-04
0.10.12	2 / 3	2014-04-04
0.10.10	2 / 3	2014-03-05
0.10.9	2 / 3	2014-03-01
0.10.8	2 / 3	2014-03-01
0.10.7	2 / 3	2014-02-21
0.10.6	2 / 3	2014-02-14
0.10.5	2 / 3	2014-02-10
0.10.4	2 / 3	2014-02-03
0.10.2	2 / 3	2014-01-20
0.10.1	2 / 3	2014-01-16

v0.12.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.2

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mikermcneil → sgress454 (on 2016-07-08) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2016-07-08. This could indicate a legitimate maintainer transition or an account compromise.

v0.12.1

2 findings

HIGH Publisher changed: sgress454 → mikermcneil (on 2016-02-05) provenance

This version was published by a different npm account than previous versions on 2016-02-05. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: balderdashy → sgress454 (on 2014-12-19) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-12-19. This could indicate a legitimate maintainer transition or an account compromise.

v0.11.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: sgress454 → balderdashy (on 2014-12-17) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-12-17. This could indicate a legitimate maintainer transition or an account compromise.

v0.10.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.19

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: balderdashy → sgress454 (on 2014-07-26) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-07-26. This could indicate a legitimate maintainer transition or an account compromise.

v0.10.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.12

4 findings

HIGH New file with network + code execution: templates/assets/js/dependencies/angular.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: templates/assets/js/dependencies/sails.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: templates/assets/js/dependencies/sails.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.7

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: sgress454 → balderdashy (on 2014-02-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-02-21. This could indicate a legitimate maintainer transition or an account compromise.

v0.10.6

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: balderdashy → sgress454 (on 2014-02-14) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2014-02-14. This could indicate a legitimate maintainer transition or an account compromise.

v0.10.5

2 findings

HIGH New file with network + code execution: templates/assets/js/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.