← Home

@absolutejs/rag

npm Homepage
32
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

alexkahndev

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Minor pipeline change, no behavioral diff vs prior approved version. ai
source-diff obfuscated-file:dist/src/rag/types.d.ts AI (source-diff): Long single-line .d.ts type list, not obfuscation. ai
source-diff obfuscated-file:dist/rag/index.js AI (source-diff): Bundled build output. ai
source-diff obfuscated-file:dist/src/rag/index.d.ts AI (source-diff): Long single-line .d.ts export list, not obfuscation. ai
source-diff obfuscated-file:dist/rag/ui.js AI (source-diff): Bundled build output. ai
source-diff obfuscated-file:dist/rag/quality.js AI (source-diff): Bundled build output. ai
source-diff obfuscated-file:dist/src/rag/quality.d.ts AI (source-diff): Long single-line .d.ts type list, not obfuscation. ai
dependencies unvetted-dep:@absolutejs/sync AI (dependencies): First-party same-org dependency of AbsoluteJS ecosystem. ai
phantom-deps phantom-dep:@sinclair/typebox AI (phantom-deps): Used in config/type declarations, common for typebox schema packages. ai
dependencies unvetted-dep:@absolutejs/manifest AI (dependencies): First-party AbsoluteJS org package, same publisher ecosystem. ai
source-diff net-exec-file:dist/manifest.js AI (source-diff): Bun-bundled first-party manifest module, not a dropper; matches @absolutejs/manifest build output. ai
source-diff obfuscated-file:dist/adapter-kit/index.js AI (source-diff): Bun-bundled dist output with readable source path comments; not obfuscation, stable pattern for this package. ai
bogus-package bogus-package AI (bogus-package): Part of the @absolutejs org ecosystem; sparse metadata is a style choice, not spam. ai
source-diff obfuscated-file:dist/client/index.js AI (source-diff): Bun-bundled output with readable source; long lines from bundler, not obfuscation. ai
source-diff obfuscated-file:dist/src/quality/quality.d.ts AI (source-diff): Long TypeScript declaration file with readable type names; not obfuscated. ai
source-diff obfuscated-file:dist/src/index.d.ts AI (source-diff): Long TypeScript declaration file with readable export names; not obfuscated. ai
source-diff obfuscated-file:dist/quality/quality.js AI (source-diff): Bun-bundled output with readable source; long lines from bundler, not obfuscation. ai
source-diff obfuscated-file:dist/presentation/ui.js AI (source-diff): Bun-bundled output with readable source; long lines from bundler, not obfuscation. ai
source-diff obfuscated-file:dist/index.js AI (source-diff): Bun-bundled output with readable source; long lines from bundler, not obfuscation. ai
source-diff obfuscated-file:dist/client/ui.js AI (source-diff): Bun-bundled output with readable source; long lines from bundler, not obfuscation. ai
source-diff obfuscated-file:dist/src/ai/rag/types.d.ts AI (source-diff): Long lines are TypeScript re-export type declarations. False positive for bundled .d.ts files. ai
source-diff obfuscated-file:dist/src/ai/rag/quality.d.ts AI (source-diff): Long lines are TypeScript type union declarations. False positive for bundled .d.ts files. ai
source-diff obfuscated-file:dist/src/ai/rag/index.d.ts AI (source-diff): Long lines are TypeScript declaration exports, not obfuscated code. Stable pattern for this bundled .d.ts package. ai
phantom-deps phantom-dep:@absolutejs/linked-providers AI (phantom-deps): Same-org dependency; phantom-dep heuristic unreliable for scoped monorepo packages. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped RAG framework package; edit-distance match to 'pg' is coincidental, not a typosquat. ai

Versions (showing 32 of 32)

Version Deps Published
0.1.1 2 / 21
0.1.0 2 / 21
0.0.31 2 / 21
0.0.30 4 / 20
0.0.29 5 / 19
0.0.28 3 / 19
0.0.27 3 / 19
0.0.26 3 / 19
0.0.25 3 / 19
0.0.24 3 / 19
0.0.23 3 / 19
0.0.22 3 / 17
0.0.20 2 / 17
0.0.19 2 / 16
0.0.18 2 / 16
0.0.17 2 / 16
0.0.16 2 / 16
0.0.15 2 / 16
0.0.14 2 / 16
0.0.13 2 / 16
0.0.12 2 / 16
0.0.11 2 / 16
0.0.10 2 / 16
0.0.9 2 / 16
0.0.8 2 / 16
0.0.7 2 / 16
0.0.6 2 / 16
0.0.5 2 / 16
0.0.4 2 / 16
0.0.3 2 / 16
0.0.2 2 / 8
0.0.1 3 / 7

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.29

3 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexkahndev.

HIGH New file with network + code execution: dist/manifest.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.28

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexkahndev.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.20

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexkahndev.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.17

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: alexkahndev.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.