semistandard
All the goodness of `feross/standard` with semicolons sprinkled on top.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Documented legitimate maintainer transition from feross to voxpelli; voxpelli is a known contributor to the standard/semistandard ecosystem with a strong track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (voxpelli, jprichardson, watson, raynos, toddbluhm) are known contributors to the standard ecosystem; this reflects a legitimate team transition. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-node | AI (phantom-deps): semistandard is an ESLint config wrapper; plugins are declared as deps and referenced in config files rather than directly imported — this is the expected pattern for this type of package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-import | AI (phantom-deps): ESLint plugins are loaded by ESLint via config files, not directly imported in JS. Standard pattern for ESLint tooling packages. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-promise | AI (phantom-deps): ESLint plugins are loaded by ESLint via config files, not directly imported in JS. Standard pattern for ESLint tooling packages. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval('import(...)') is a static-string ESM compatibility shim in bin/cmd.js; input is not user-controlled. Legitimate pattern for this package. | ai | |
| phantom-deps | phantom-dep:eslint-config-semistandard | AI (phantom-deps): ESLint configs are referenced in ESLint config files, not directly imported. Standard pattern for ESLint tooling packages. | ai | |
| phantom-deps | phantom-dep:eslint-config-standard-jsx | AI (phantom-deps): ESLint configs are referenced in ESLint config files, not directly imported. Standard pattern for ESLint tooling packages. | ai | |
| phantom-deps | phantom-dep:eslint-config-standard | AI (phantom-deps): ESLint configs are referenced in ESLint config files, not directly imported. Standard pattern for ESLint tooling packages. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-n | AI (phantom-deps): ESLint plugins are loaded by ESLint via config files, not directly imported in JS. Standard pattern for ESLint tooling packages. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-react | AI (phantom-deps): ESLint plugins are loaded by ESLint via config files, not directly imported in JS. Standard pattern for ESLint tooling packages. | ai |
Versions (showing 66 of 66)
| Version | Deps | Published |
|---|---|---|
| 17.0.0 | 9 / 7 | |
| 16.0.1 | 9 / 7 | |
| 16.0.0 | 10 / 7 | |
| 15.0.0 | 10 / 7 | |
| 14.2.3 | 10 / 7 | |
| 14.2.2 | 10 / 7 | |
| 14.2.1 | 10 / 7 | |
| 14.2.0 | 10 / 7 | |
| 14.1.0 | 10 / 7 | |
| 14.0.1 | 10 / 7 | |
| 14.0.0 | 10 / 7 | |
| 13.0.1 | 10 / 7 | |
| 13.0.0 | 10 / 7 | |
| 12.0.1 | 10 / 7 | |
| 12.0.0 | 10 / 7 | |
| 11.0.0 | 10 / 7 | |
| 10.0.0 | 8 / 7 | |
| 9.2.1 | 8 / 7 | |
| 9.2.0 | 8 / 7 | |
| 9.1.0 | 9 / 7 | |
| 9.0.0 | 9 / 7 | |
| 8.0.0 | 9 / 7 | |
| 7.0.5 | 11 / 8 | |
| 7.0.4 | 11 / 8 | |
| 7.0.3 | 11 / 8 | |
| 7.0.2 | 11 / 8 | |
| 7.0.1 | 11 / 8 | |
| 7.0.0 | 11 / 9 | |
| 6.1.2 | 9 / 8 | |
| 6.1.1 | 9 / 8 | |
| 6.1.0 | 9 / 8 | |
| 6.0.0 | 9 / 8 | |
| 5.0.0 | 6 / 9 | |
| 4.3.0 | 6 / 9 | |
| 4.2.2 | 6 / 9 | |
| 4.2.1 | 6 / 9 | |
| 4.2.0 | 6 / 9 | |
| 4.1.4 | 1 / 9 | |
| 4.1.3 | 1 / 9 | |
| 4.1.2 | 1 / 9 | |
| 4.1.1 | 1 / 8 | |
| 4.1.0 | 1 / 8 | |
| 4.0.3 | 1 / 8 | |
| 4.0.2 | 1 / 8 | |
| 4.0.1 | 1 / 8 | |
| 4.0.0 | 1 / 8 | |
| 3.3.0 | 10 / 8 | |
| 3.1.2 | 17 / 7 | |
| 2.10.0 | 13 / 7 | |
| 2.6.5 | 10 / 7 | |
| 2.6.2 | 10 / 7 | |
| 2.6.0 | 10 / 7 | |
| 2.5.0 | 10 / 7 | |
| 2.4.5 | 10 / 7 | |
| 2.4.4 | 9 / 7 | |
| 2.4.1 | 2 / 0 | |
| 2.3.2 | 2 / 0 | |
| 2.3.1 | 2 / 0 | |
| 2.3.0 | 2 / 0 | |
| 2.2.1 | 2 / 0 | |
| 2.2.0 | 2 / 0 | |
| 2.1.0 | 2 / 0 | |
| 2.0.0 | 2 / 0 | |
| 1.0.2 | 2 / 0 | |
| 1.0.1 | 2 / 0 | |
| 1.0.0 | 2 / 0 |
v17.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.0.1
2 findingsThis version was published by a different npm account than previous versions on 2021-06-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v16.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.