turbo
Turborepo is a high-performance build system for JavaScript and TypeScript codebases.
100
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
vercel-release-botturbobot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:turbo-linux-mips64le | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| phantom-deps | phantom-dep:turbo-linux-32 | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| phantom-deps | phantom-dep:turbo-linux-arm | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| phantom-deps | phantom-dep:turbo-freebsd-64 | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| phantom-deps | phantom-dep:turbo-windows-32 | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| phantom-deps | phantom-dep:turbo-freebsd-arm64 | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| phantom-deps | phantom-dep:turbo-linux-ppc64le | AI (phantom-deps): Platform-specific optional binary dependency — standard cross-platform binary distribution pattern for turbo. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): turbo's postinstall runs install.js to select and install the correct platform-specific binary — standard documented pattern for cross-platform binary distribution, stable across versions. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): process.env spread is used to sanitize npm_config_global to prevent install deadlock — defensive pattern, not credential exfiltration. Confirmed in public Vercel/turborepo source. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used to run nested npm install for platform binary selection — expected and documented behavior for turbo's binary installer. | ai | |
| phantom-deps | phantom-dep:turbo-darwin-64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for cross-platform CLI tools. | ai | |
| phantom-deps | phantom-dep:turbo-windows-64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for cross-platform CLI tools. | ai | |
| phantom-deps | phantom-dep:turbo-linux-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for cross-platform CLI tools. | ai | |
| phantom-deps | phantom-dep:turbo-darwin-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for cross-platform CLI tools. | ai | |
| phantom-deps | phantom-dep:turbo-windows-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for cross-platform CLI tools. | ai | |
| phantom-deps | phantom-dep:turbo-linux-64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for cross-platform CLI tools. | ai |
Versions (showing 100 of 485)
Showing 100 of 485
Next page →