@abi-software/mapintegratedvuer
This project aims to provide an application to visually navigate anatomical entities to discover functional and physiological datasets from organ-specific neural circuitry.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/ContentMixin-CLr2YdhY.js | AI (source-diff): Standard Vite build output for this Vue component library; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-o_HxI1zc.js | AI (source-diff): Standard Vite bundle; samples show normal Vue/Pinia imports with no malicious patterns. | ai | |
| source-diff | net-exec-file:dist/index-o_HxI1zc.js | AI (source-diff): Network calls and dynamic code in a Vue UI library bundle are expected; no dropper/loader patterns visible in samples. | ai | |
| phantom-deps | phantom-dep:css-element-queries | AI (phantom-deps): Likely used in bundled Vue SFCs; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@abi-software/svg-sprite | AI (phantom-deps): Same-org dep used in bundled components; stable FP. | ai | |
| phantom-deps | phantom-dep:xss | AI (phantom-deps): Likely used in bundled Vue SFCs; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@abi-software/sparc-annotation | AI (phantom-deps): Same-org dep used in bundled components; stable FP. | ai | |
| phantom-deps | phantom-dep:@abi-software/map-side-bar | AI (phantom-deps): Same-org dep used in bundled components; stable FP. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): Likely used in bundled Vue SFCs; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:splitpanes | AI (phantom-deps): Likely used in bundled Vue SFCs; stable false positive for this package. | ai |
v1.18.1
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.17.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.