← Home

@amplitude/plugin-session-replay-browser

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

curtisbliukelson.warnersdk.deveric_amplitudedaniel-graham-amplitudejjwang123

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:@amplitude/analytics-client-common AI (phantom-deps): Same-org internal dependency; stable pattern for this package. ai
phantom-deps phantom-dep:@amplitude/analytics-core AI (phantom-deps): Same-org internal dependency; stable pattern for this package. ai
source-diff obfuscated-file-transition:lib/scripts/observers-min.js AI (source-diff): Rollup/terser minified build output with sourcemaps, not obfuscation; stable for this package. ai
dependencies unvetted-dep:@amplitude/rrweb-plugin-console-record AI (dependencies): Same-org Amplitude dependency used in session replay; stable pattern across versions. ai
dependencies unvetted-dep:@amplitude/rrweb-record AI (dependencies): Same-org Amplitude dependency used in session replay; stable pattern across versions. ai
source-diff encoded-string-file:lib/scripts/plugin-session-replay-browser-esm.js AI (source-diff): Standard minified TypeScript bundle output; samples show normal TS helpers, not obfuscated payloads. ai
provenance missing-githead AI (provenance): SLSA provenance attestation present; missing gitHead reflects CI config change, not integrity loss. ai
source-diff encoded-string-file:lib/scripts/plugin-session-replay-browser-min.js AI (source-diff): Minified SDK bundle; long encoded strings are expected build artifacts for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Fires on minified session-replay bundle; expected pattern for this package, not malicious obfuscation. ai
phantom-deps phantom-dep:@amplitude/rrweb-plugin-console-record AI (phantom-deps): First-party @amplitude dep bundled into output; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:@amplitude/rrweb-record AI (phantom-deps): First-party @amplitude dep bundled into output; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:idb-keyval AI (phantom-deps): idb-keyval is a declared runtime dep; phantom-dep heuristic false positive for this bundled package. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Fires on minified bundle; Reflect.get in minified code is a standard JS pattern, not evasion. ai

Versions (showing 100 of 189)

Version Deps Published
1.33.6 8 / 12
1.33.5 8 / 12
1.33.4 8 / 12
1.33.3 8 / 12
1.33.2 8 / 12
1.33.1 8 / 12
1.33.0 8 / 12
1.32.3 8 / 12
1.32.2 8 / 12
1.32.1 8 / 12
1.32.0 8 / 12
1.31.2 8 / 12
1.31.1 8 / 12
1.31.0 8 / 12
1.30.5 8 / 12
1.30.4 8 / 12
1.30.3 8 / 12
1.30.2 8 / 12
1.30.1 8 / 12
1.30.0 8 / 12
1.29.0 8 / 12
1.28.1 8 / 12
1.28.0 8 / 12
1.27.10 8 / 12
1.27.9 8 / 12
1.27.8 8 / 12
1.27.7 8 / 12
1.27.6 8 / 13
1.27.5 8 / 13
1.27.4 8 / 13
1.27.3 8 / 13
1.27.2 8 / 13
1.27.1 8 / 13
1.27.0 8 / 13
1.26.4 8 / 13
1.26.3 8 / 13
1.26.2 8 / 13
1.26.1 8 / 13
1.26.0 8 / 13
1.25.21 8 / 13
1.25.20 8 / 13
1.25.19 8 / 13
1.25.18 8 / 13
1.25.17 8 / 13
1.25.16 8 / 13
1.25.15 8 / 13
1.25.14 8 / 13
1.25.13 8 / 13
1.25.12 8 / 13
1.25.11 8 / 13
1.25.10 8 / 13
1.25.9 8 / 12
1.25.8 8 / 12
1.25.7 8 / 12
1.25.6 8 / 12
1.25.5 6 / 11
1.25.4 6 / 11
1.25.3 6 / 11
1.25.2 6 / 11
1.25.1 6 / 11
1.25.0 6 / 11
1.24.1 6 / 11
1.24.0 6 / 11
1.23.6 6 / 11
1.23.5 6 / 11
1.23.4 6 / 11
1.23.3 6 / 11
1.23.2 6 / 11
1.23.1 6 / 11
1.23.0 6 / 11
1.22.27 6 / 11
1.22.26 6 / 11
1.22.25 6 / 11
1.22.24 6 / 11
1.22.23 6 / 11
1.22.22 6 / 11
1.22.21 6 / 11
1.22.20 6 / 11
1.22.19 6 / 11
1.22.18 6 / 11
1.22.17 6 / 11
1.22.16 6 / 11
1.22.15 6 / 11
1.22.14 6 / 11
1.22.13 6 / 11
1.22.12 6 / 11
1.22.11 6 / 11
1.22.10 6 / 11
1.22.9 6 / 11
1.22.8 6 / 11
1.22.7 6 / 11
1.22.6 6 / 11
1.22.5 6 / 11
1.22.4 6 / 11
1.22.3 6 / 11
1.22.2 6 / 11
1.22.1 6 / 11
1.22.0 6 / 11
1.21.1 4 / 11
1.21.0 4 / 11
Showing 100 of 189 Next page →

v1.33.6

2 findings
HIGH Modified file became obfuscated: lib/scripts/observers-min.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.33.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.33.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.33.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.33.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.33.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.33.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.23.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.23.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.22.27

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.22.26

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.22.25

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.22.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.22.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.22.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.22.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.21.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.21.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.