@actual-app/api
An API for Actual
12
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
matissjanisdolphishjoeljeremymatt-fiddactualbudget
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/worker.js | AI (source-diff): Rolldown/vite bundle output; minified build artifact, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/worker.js | AI (source-diff): Network + dynamic code in a bundled SQLite/WASM worker is expected for this package's browser DB functionality. | ai | |
| source-diff | obfuscated-file:dist/browser.js | AI (source-diff): Rolldown/vite bundle output with web-worker base64 inlining; not obfuscation. | ai | |
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Base64 string is a protobuf file descriptor (fileDesc call), standard protobuf-es pattern. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publishing with SLSA/Sigstore attestation; legitimate CI/CD migration for actualbudget org. | ai | |
| phantom-deps | phantom-dep:compare-versions | AI (phantom-deps): Referenced in config files per finding; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@actual-app/crdt | AI (phantom-deps): Same org scope (@actual-app); likely used transitively or in build config, not a risk. | ai | |
| phantom-deps | phantom-dep:better-sqlite3 | AI (phantom-deps): better-sqlite3 is a declared runtime dep used as a SQLite backend; referenced in config files rather than direct JS imports is normal for this package's architecture. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package has 389 versions and 13.7k weekly downloads; dormancy flag reflects new publisher account (matissjanis), not actual package inactivity. Legitimate maintainer transition. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): @actual-app/api is the legitimate Actual Budget API package; scoped name similarity to 'hapi' is purely coincidental string distance, not impersonation. | ai | |
| dependencies | unvetted-dep:@actual-app/crdt | AI (dependencies): First-party dependency from the same @actual-app org; expected internal dependency for Actual Budget packages. | ai | |
| dependencies | unvetted-dep:@actual-app/core | AI (dependencies): First-party dependency from the same @actual-app org; expected internal dependency for Actual Budget packages. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped package @actual-app/api has no plausible impersonation relationship to 'ajv'; false positive from Levenshtein distance on full scoped name. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @actual-app/api has no plausible impersonation relationship to 'joi'; false positive from Levenshtein distance on full scoped name. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package @actual-app/api has no plausible impersonation relationship to 'pg'; false positive from Levenshtein distance on full scoped name. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 26.7.0 | 5 / 8 | |
| 26.6.0 | 5 / 6 | |
| 26.5.2 | 5 / 6 | |
| 26.5.1 | 5 / 6 | |
| 26.5.0 | 4 / 6 | |
| 26.4.0 | 6 / 7 | |
| 26.3.0 | 5 / 4 | |
| 26.2.1 | 5 / 3 | |
| 26.2.0 | 5 / 3 | |
| 26.1.0 | 5 / 3 | |
| 25.12.0 | 5 / 3 | |
| 25.11.0 | 5 / 3 |
v26.7.0
5 findings
HIGH
New obfuscated file: dist/browser.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/worker.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/worker.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
Long encoded string in modified file: dist/index.js
source-diff
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.