@artel/artc — Greenflagged

Артель Компилятор | Artel Compiler

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ychetyrko

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:build/chunk-7EMGC6AD.js	AI (source-diff): Large bundled build artifact for a compiler tool; network+exec pattern is from bundled Babel/TS runtime helpers, not dropper malware.	ai	2026/06/07
source-diff	net-exec-file:build/chunk-Y3SDLINT.js	AI (source-diff): Large bundled compiler output; net+exec pattern is inherent to a compiler/transpiler tool, not malware.	ai	2026/06/07
source-diff	net-exec-file:build/chunk-HOEHBJ7R.js	AI (source-diff): Large bundled build artifact for a compiler tool; network+exec pattern is from bundled Babel/TS runtime helpers, not dropper behavior.	ai	2026/06/07
source-diff	net-exec-file:build/chunk-S6SV63VD.js	AI (source-diff): Large bundled compiler artifact; network+exec pattern is from bundled language-server/compiler code, not malware.	ai	2026/06/06
source-diff	net-exec-file:build/chunk-6YPLDA76.js	AI (source-diff): Compiler/language-server bundle; network+code-exec pattern is inherent to this package's purpose, not malware.	ai	2026/06/06
source-diff	net-exec-file:build/chunk-7D775S4V.js	AI (source-diff): Large bundled compiler artifact; sample shows standard TS polyfill boilerplate, not dropper/loader code.	ai	2026/06/06
source-diff	net-exec-file:build/chunk-TSATPA2U.js	AI (source-diff): Large bundled build artifact for a compiler package; network+exec pattern is from bundled toolchain code, not malware.	ai	2026/06/06
source-diff	net-exec-file:build/chunk-DB2CJDOL.js	AI (source-diff): Build bundle for a compiler package; network+exec pattern is from bundled compiler/LSP code, not dropper malware.	ai	2026/06/06
source-diff	net-exec-file:build/chunk-K3EBH7V6.js	AI (source-diff): Large bundled compiler output; network+exec pattern is from bundled toolchain code, not dropper behavior.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-FIIGCVSM.js	AI (source-diff): Large bundled compiler output; net+exec pattern is from bundled Babel/TS toolchain, not malware.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-O2F523M5.js	AI (source-diff): Large bundled build artifact with standard esbuild boilerplate; network+exec pattern is expected for a compiler package.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-3PVSYUJV.js	AI (source-diff): Large bundled compiler artifact; sample shows standard build helpers, not malicious network+exec pattern.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-4YMBG4SM.js	AI (source-diff): Compiler bundle artifact; sample shows standard esbuild/rollup helpers, not malicious network+exec pattern.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-3JS4YG6N.js	AI (source-diff): Compiler/language-server build bundle; network+exec pattern is expected for this tool's functionality, not malware.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-VRGYQLZL.js	AI (source-diff): Compiler package; bundled build output with network/eval patterns is expected for a transpiler/compiler tool.	ai	2026/06/05
source-diff	net-exec-file:build/chunk-2Q4QKW7T.js	AI (source-diff): Large bundled compiler artifact; network+exec pattern is from bundled deps (Babel, TS, vscode-languageserver), not malware.	ai	2026/06/04
source-diff	net-exec-file:build/chunk-FCVCEIPF.js	AI (source-diff): 3MB esbuild bundle for a compiler package; sample shows standard decorator/async helpers, not malware.	ai	2026/06/03
source-diff	net-exec-file:build/chunk-MN7XRSIB.js	AI (source-diff): Large bundled compiler artifact; sample shows standard build helpers, not malware patterns.	ai	2026/06/03
source-diff	net-exec-file:build/chunk-7EXJHYWX.js	AI (source-diff): Bundled compiler artifact; sample shows standard build helpers, not dropper/loader malware.	ai	2026/06/03
publish-pattern	new-deps-added	AI (publish-pattern): Babel deps are well-known transpiler packages consistent with compiler functionality.	ai	2026/06/02
source-diff	net-exec-file:build/chunk-ZV4RVSWH.js	AI (source-diff): Large bundled build artifact for a compiler tool; boilerplate JS helpers, not malware patterns.	ai	2026/06/02
source-diff	net-exec-file:build/chunk-SJFIPH42.js	AI (source-diff): Large bundled build artifact from established Artel compiler; network+exec pattern is from legitimate compiler/LSP functionality, not malware.	ai	2026/06/02
source-diff	net-exec-file:build/chunk-ER3TEZSN.js	AI (source-diff): Bundled compiler output; esbuild/tsc artifact with standard async/decorator helpers, not dropper code.	ai	2026/06/02
source-diff	net-exec-file:build/chunk-CWGZOWF7.js	AI (source-diff): Bundled compiler artifact; network+exec pattern comes from vscode-languageserver and compiler internals, not malware.	ai	2026/06/02
source-diff	net-exec-file:build/chunk-MLUN6742.js	AI (source-diff): Compiler package; bundled chunk with network+exec patterns is expected for a language compiler/toolchain artifact.	ai	2026/06/02
source-diff	net-exec-file:build/chunk-CS2AK7Z7.js	AI (source-diff): Compiler package; large bundled build artifacts with network+exec patterns are expected and stable across versions.	ai	2026/06/01
source-diff	net-exec-file:build/chunk-PDVQZURU.js	AI (source-diff): Large bundled compiler artifact; network+exec pattern is from bundled LSP/compiler code, not dropper malware.	ai	2026/06/01
source-diff	net-exec-file:build/chunk-E72KEKQV.js	AI (source-diff): Large bundled compiler artifact; network/exec patterns are from bundled deps (vscode-languageserver, babel), not malicious dropper code.	ai	2026/05/31
source-diff	net-exec-file:build/chunk-3VRPBHJN.js	AI (source-diff): Large bundled build artifact from a compiler project; network+exec pattern reflects bundled compiler/LSP code, not malware.	ai	2026/05/31
source-diff	net-exec-file:build/chunk-YNG6354X.js	AI (source-diff): Standard esbuild/rollup bundle for Artel Compiler; bundler boilerplate, not dropper malware.	ai	2026/05/30
source-diff	net-exec-file:build/chunk-LX6LUKPR.js	AI (source-diff): Bundled esbuild output for a compiler package; network+exec pattern is from legitimate async/fetch patterns in the bundle, not dropper behavior.	ai	2026/05/30
source-diff	net-exec-file:build/chunk-EVYL6VFM.js	AI (source-diff): Large bundled compiler output (esbuild); network+exec pattern is from bundled deps, not malware.	ai	2026/05/29
source-diff	net-exec-file:build/chunk-LD2OIYWC.js	AI (source-diff): Bundled compiler artifact; sample shows standard build helpers, not dropper/loader patterns.	ai	2026/05/27
source-diff	obfuscated-file:build/types/tree/Nodes.d.ts	AI (source-diff): Large .d.ts with long union type lines is expected for a compiler's AST node declarations.	ai	2026/05/27
source-diff	net-exec-file:build/chunk-RQOGIK5O.js	AI (source-diff): Compiler/transpiler tool; bundled Babel+TS internals legitimately combine network (LSP) and code execution (transform) patterns.	ai	2026/05/15
source-diff	net-exec-file:build/chunk-KCEJTV3Q.js	AI (source-diff): Large bundled build artifact from a compiler package; sample shows standard bundle boilerplate, not malware.	ai	2026/05/15
source-diff	net-exec-file:build/chunk-Y77RKBXA.js	AI (source-diff): 4.6MB bundled compiler artifact; sample shows only standard bundler/decorator boilerplate, no actual network or eval patterns.	ai	2026/05/15
provenance	no-provenance	AI (provenance): Established package with consistent release history; lack of provenance is common and not a risk signal here.	ai	2026/04/28
phantom-deps	phantom-dep:vscode-json-languageservice	AI (phantom-deps): VSCode language service dep referenced via config, stable false positive.	ai	2026/04/28
phantom-deps	phantom-dep:jsonc-parser	AI (phantom-deps): Referenced in config files, stable false positive for this compiler package.	ai	2026/04/28
phantom-deps	phantom-dep:@vscode/l10n	AI (phantom-deps): VSCode tooling dep referenced via config, stable false positive for this package.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/plugin-transform-class-properties	AI (phantom-deps): Babel plugin loaded by convention, not directly imported.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/plugin-proposal-decorators	AI (phantom-deps): Babel plugin loaded by convention, not directly imported.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/generator	AI (phantom-deps): Babel packages are framework-scoped build deps, not directly imported at runtime.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/parser	AI (phantom-deps): Babel packages are framework-scoped build deps, not directly imported at runtime.	ai	2026/04/28
phantom-deps	phantom-dep:@babel/core	AI (phantom-deps): Babel packages are framework-scoped build deps, not directly imported at runtime.	ai	2026/04/28

Versions (showing 51 of 56)

View all versions

Version	Deps	Published
0.9.26016	14 / 3	2026-05-01
0.9.26003	14 / 3	2026-04-30
0.6.26039	14 / 3	2026-04-25
0.6.26038	14 / 3	2026-04-24
0.6.26035	14 / 3	2026-04-17
0.6.26034	14 / 3	2026-04-17
0.6.26032	14 / 3	2026-04-17
0.6.26031	14 / 3	2026-04-17
0.6.26030	14 / 3	2026-04-17
0.6.26029	14 / 3	2026-04-17
0.6.26028	14 / 3	2026-04-16
0.6.26027	14 / 3	2026-04-16
0.6.26026	14 / 3	2026-04-14
0.6.26025	14 / 3	2026-04-06
0.6.26024	14 / 3	2026-03-30
0.6.26023	14 / 3	2026-03-20
0.6.26022	14 / 3	2026-03-10
0.6.26017	14 / 2	2026-02-12
0.6.26015	14 / 2	2026-02-04
0.6.26014	14 / 2	2026-02-04
0.6.26010	14 / 2	2026-01-29
0.6.26009	14 / 2	2026-01-27
0.6.26008	14 / 2	2026-01-27
0.6.26006	14 / 2	2026-01-22
0.6.26004	14 / 2	2026-01-12
0.6.26003	14 / 2	2026-01-09
0.6.26001	14 / 2	2026-01-08
0.6.25290	14 / 2	2025-12-23
0.6.25286	11 / 2	2025-12-05
0.6.25283	11 / 2	2025-11-20
0.6.25279	11 / 2	2025-11-01
0.6.25278	11 / 2	2025-10-30
0.6.25277	11 / 2	2025-10-23
0.6.25276	11 / 2	2025-10-23
0.6.25275	11 / 2	2025-10-20
0.6.25273	11 / 2	2025-10-17
0.6.25271	11 / 2	2025-10-15
0.6.25270	11 / 2	2025-10-14
0.6.25266	11 / 2	2025-10-10
0.6.25256	11 / 2	2025-09-23
0.6.25254	11 / 2	2025-08-27
0.6.25248	11 / 2	2025-07-30
0.6.25247	11 / 2	2025-07-29
0.6.25243	11 / 2	2025-07-11
0.6.25242	11 / 2	2025-07-10
0.6.25239	11 / 2	2025-06-30
0.6.25238	11 / 2	2025-06-30
0.6.25237	11 / 2	2025-06-28
0.6.25232	11 / 2	2025-06-16
0.6.25229	11 / 2	2025-05-28
0.6.25228	11 / 2	2025-05-28

v0.9.26016

2 findings

HIGH New file with network + code execution: build/chunk-Y77RKBXA.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.26003

2 findings

HIGH New file with network + code execution: build/chunk-MLUN6742.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26039

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26038

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26035

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26034

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26032

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26031

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26030

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26029

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26028

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26027

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26026

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26025

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26024

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.26023

2 findings

HIGH New file with network + code execution: build/chunk-RQOGIK5O.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26022

2 findings

HIGH New file with network + code execution: build/chunk-KCEJTV3Q.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26017

2 findings

HIGH New file with network + code execution: build/chunk-SJFIPH42.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26015

2 findings

HIGH New file with network + code execution: build/chunk-Y3SDLINT.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26014

2 findings

HIGH New file with network + code execution: build/chunk-K3EBH7V6.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26010

2 findings

HIGH New file with network + code execution: build/chunk-HOEHBJ7R.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26009

2 findings

HIGH New file with network + code execution: build/chunk-7EMGC6AD.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26008

2 findings

HIGH New file with network + code execution: build/chunk-O2F523M5.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26006

2 findings

HIGH New file with network + code execution: build/chunk-FIIGCVSM.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26004

2 findings

HIGH New file with network + code execution: build/chunk-VRGYQLZL.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26003

2 findings

HIGH New file with network + code execution: build/chunk-MN7XRSIB.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.26001

2 findings

HIGH New file with network + code execution: build/chunk-TSATPA2U.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25290

2 findings

HIGH New file with network + code execution: build/chunk-ZV4RVSWH.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25286

2 findings

HIGH New file with network + code execution: build/chunk-FCVCEIPF.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25283

2 findings

HIGH New file with network + code execution: build/chunk-2Q4QKW7T.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25279

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.25278

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.25277

3 findings

HIGH New file with network + code execution: build/chunk-EVYL6VFM.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25276

3 findings

HIGH New file with network + code execution: build/chunk-LX6LUKPR.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25275

3 findings

HIGH New file with network + code execution: build/chunk-DB2CJDOL.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25273

3 findings

HIGH New file with network + code execution: build/chunk-7EXJHYWX.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25271

3 findings

HIGH New file with network + code execution: build/chunk-LD2OIYWC.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25270

3 findings

HIGH New file with network + code execution: build/chunk-YNG6354X.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25266

3 findings

HIGH New file with network + code execution: build/chunk-4YMBG4SM.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25256

3 findings

HIGH New file with network + code execution: build/chunk-ER3TEZSN.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: build/types/tree/Nodes.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25254

2 findings

HIGH New file with network + code execution: build/chunk-3JS4YG6N.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25248

2 findings

HIGH New file with network + code execution: build/chunk-CWGZOWF7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25247

2 findings

HIGH New file with network + code execution: build/chunk-3PVSYUJV.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25243

2 findings

HIGH New file with network + code execution: build/chunk-7D775S4V.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25242

2 findings

HIGH New file with network + code execution: build/chunk-CS2AK7Z7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25239

2 findings

HIGH New file with network + code execution: build/chunk-3VRPBHJN.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25238

2 findings

HIGH New file with network + code execution: build/chunk-S6SV63VD.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25237

2 findings

HIGH New file with network + code execution: build/chunk-PDVQZURU.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25232

2 findings

HIGH New file with network + code execution: build/chunk-E72KEKQV.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25229

2 findings

HIGH New file with network + code execution: build/chunk-6YPLDA76.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.25228

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.