Pinned artifact: paseo-plugin-tunnel@0.3.2, source commit 65d165c02ae6c03138e3a479d0e4607cb9b20996.
The install-time hold clears under the current review policy. Specific other-host dependency review accepted by parent: all 547 lockfile URLs are registry.npmmirror.com, all 547 integrity values match public npm metadata. Five actual production tarballs fetched at those mirror URLs and SHA512 verified. npm ci --omit=dev --ignore-scripts installs only those; do not describe resolutions as public npm.
Encrypted HTTP service connections between trusted Paseo hosts. @getpaseo/relay/e2ee supplies Curve25519/XSalsa20-Poly1305 transport, ws supplies sockets, zod validates configuration; base64-js/tweetnacl are relay transitives.
Every published file matches pinned npm gitHead. Mirror host exception does not alter artifact/source pin. No plugin, installation or lifecycle code was executed during this static review. No surviving review finding remains. This issue stays open until the matching import and overview PR is ready.
Pinned artifact:
paseo-plugin-tunnel@0.3.2, source commit65d165c02ae6c03138e3a479d0e4607cb9b20996.The install-time hold clears under the current review policy. Specific other-host dependency review accepted by parent: all 547 lockfile URLs are registry.npmmirror.com, all 547 integrity values match public npm metadata. Five actual production tarballs fetched at those mirror URLs and SHA512 verified. npm ci --omit=dev --ignore-scripts installs only those; do not describe resolutions as public npm.
Encrypted HTTP service connections between trusted Paseo hosts. @getpaseo/relay/e2ee supplies Curve25519/XSalsa20-Poly1305 transport, ws supplies sockets, zod validates configuration; base64-js/tweetnacl are relay transitives.
Every published file matches pinned npm gitHead. Mirror host exception does not alter artifact/source pin. No plugin, installation or lifecycle code was executed during this static review. No surviving review finding remains. This issue stays open until the matching import and overview PR is ready.