unstorage — Greenflagged

Universal Storage Layer

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

pi0

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:base64-decode	AI (semgrep): Base64 decoding in azure-key-vault driver is standard Azure Key Vault integration code for decoding secret values; not a malicious payload.	ai	2026/04/21
dependencies	unvetted-dep:h3	AI (dependencies): h3 is a well-known unjs HTTP framework maintained by the same author (pi0); legitimate ecosystem dependency.	ai	2026/04/21
dependencies	unvetted-dep:destr	AI (dependencies): destr is a well-known unjs safe JSON deserializer maintained by the same author (pi0); legitimate ecosystem dependency.	ai	2026/04/21
dependencies	unvetted-dep:ofetch	AI (dependencies): ofetch is a well-known unjs fetch wrapper maintained by the same author (pi0); legitimate ecosystem dependency.	ai	2026/04/21
dependencies	unvetted-dep:node-fetch-native	AI (dependencies): node-fetch-native is a well-known unjs package maintained by the same author (pi0); legitimate ecosystem dependency.	ai	2026/04/21