@alepha/devtools
Developer tools for Alepha applications.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:assets/devtools/entry.CfgGy8wg.js | AI (source-diff): Network calls are Vite modulepreload fetch; dynamic execution is standard ES module chunk loading. | ai | |
| source-diff | obfuscated-file:assets/devtools/entry.CfgGy8wg.js | AI (source-diff): Standard Vite build output; __vite__mapDeps pattern is canonical minified bundle, not obfuscation. | ai | |
| source-diff | obfuscated-file:assets/devtools/entry.r_sixgJG.js | AI (source-diff): Vite-bundled frontend asset; minification is expected for this devtools UI package. | ai | |
| source-diff | net-exec-file:assets/devtools/entry.r_sixgJG.js | AI (source-diff): Network calls and dynamic imports are standard Vite chunk-loading patterns in a browser UI bundle. | ai | |
| source-diff | obfuscated-file:assets/devtools/entry.Bkwg306k.js | AI (source-diff): Vite-bundled frontend asset; minification is expected for this devtools UI package. | ai | |
| source-diff | net-exec-file:assets/devtools/entry.Bkwg306k.js | AI (source-diff): Network calls and dynamic module loading are standard Vite chunk-splitting patterns, not dropper behavior. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 46 new files are Vite build output chunks; expected from the newly added UI build step. | ai | |
| source-diff | net-exec-file:assets/ui/chunk.p3hCiSrt.js | AI (source-diff): Vite-bundled UI chunk containing Alepha DI framework code; network calls are fetch() for modulepreload, not exfiltration. | ai | |
| source-diff | net-exec-file:dist/public/chunk.p3hCiSrt.js | AI (source-diff): Same Vite bundle duplicated to dist/public; identical benign content. | ai | |
| source-diff | obfuscated-file:assets/ui/entry.DnXws2rz.js | AI (source-diff): Standard Vite entry point with __vite__mapDeps and SVG icon definitions; minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/public/entry.DnXws2rz.js | AI (source-diff): Same Vite entry duplicated to dist/public; identical benign minified content. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by new build:ui step bundling React/Mantine/XYFlow UI into static assets. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Fires in bundled React UI chunk; Reflect.get() is standard minified framework code, not malicious obfuscation. | ai |
Versions (showing 20 of 20)
| Version | Deps | Published |
|---|---|---|
| 0.20.2 | 0 / 13 | |
| 0.19.5 | 0 / 13 | |
| 0.19.3 | 0 / 13 | |
| 0.19.2 | 0 / 13 | |
| 0.19.1 | 0 / 13 | |
| 0.15.4 | 0 / 13 | |
| 0.15.3 | 0 / 13 | |
| 0.14.2 | 0 / 13 | |
| 0.14.0 | 0 / 13 | |
| 0.13.7 | 0 / 13 | |
| 0.13.6 | 0 / 7 | |
| 0.13.5 | 0 / 7 | |
| 0.13.4 | 0 / 7 | |
| 0.13.3 | 0 / 7 | |
| 0.13.2 | 0 / 7 | |
| 0.13.1 | 0 / 7 | |
| 0.13.0 | 0 / 7 | |
| 0.12.1 | 0 / 7 | |
| 0.12.0 | 0 / 7 | |
| 0.11.12 | 0 / 7 |
v0.20.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.3
5 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.15.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.15.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.14.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.14.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.12.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.11.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.