@barchart/chart-lib
Barchart HTML5 Streaming Chart
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires inside minified chart bundle; pattern is from date/timezone parsing, not dynamic code execution of external input. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in minified bundle is a common bundler/transpiler artifact, not obfuscation for evasion. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Proprietary UNLICENSED compiled artifact; no repo/deps/keywords is expected for this distribution pattern. | ai |
Versions (showing 100 of 585)
| Version | Deps | Published |
|---|---|---|
| 2.393.1 | 0 / 0 | |
| 2.393.0 | 0 / 0 | |
| 2.392.6 | 0 / 0 | |
| 2.392.5 | 0 / 0 | |
| 2.392.4 | 0 / 0 | |
| 2.392.3 | 0 / 0 | |
| 2.392.2 | 0 / 0 | |
| 2.392.1 | 0 / 0 | |
| 2.392.0 | 0 / 0 | |
| 2.391.0 | 0 / 0 | |
| 2.390.0 | 0 / 0 | |
| 2.389.1 | 0 / 0 | |
| 2.389.0 | 0 / 0 | |
| 2.388.4 | 0 / 0 | |
| 2.388.3 | 0 / 0 | |
| 2.388.2 | 0 / 0 | |
| 2.388.1 | 0 / 0 | |
| 2.388.0 | 0 / 0 | |
| 2.387.3 | 0 / 0 | |
| 2.387.2 | 0 / 0 | |
| 2.387.1 | 0 / 0 | |
| 2.387.0 | 0 / 0 | |
| 2.386.8 | 0 / 0 | |
| 2.386.7 | 0 / 0 | |
| 2.386.6 | 0 / 0 | |
| 2.386.5 | 0 / 0 | |
| 2.386.3 | 0 / 0 | |
| 2.386.1 | 0 / 0 | |
| 2.386.0 | 0 / 0 | |
| 2.385.2 | 0 / 0 | |
| 2.385.1 | 0 / 0 | |
| 2.385.0 | 0 / 0 | |
| 2.384.3 | 0 / 0 | |
| 2.384.2 | 0 / 0 | |
| 2.384.1 | 0 / 0 | |
| 2.384.0 | 0 / 0 | |
| 2.383.1 | 0 / 0 | |
| 2.383.0 | 0 / 0 | |
| 2.382.2 | 0 / 0 | |
| 2.382.1 | 0 / 0 | |
| 2.382.0 | 0 / 0 | |
| 2.381.3 | 0 / 0 | |
| 2.381.2 | 0 / 0 | |
| 2.381.1 | 0 / 0 | |
| 2.381.0 | 0 / 0 | |
| 2.380.2 | 0 / 0 | |
| 2.380.0 | 0 / 0 | |
| 2.379.5 | 0 / 0 | |
| 2.379.4 | 0 / 0 | |
| 2.379.3 | 0 / 0 | |
| 2.379.2 | 0 / 0 | |
| 2.379.1 | 0 / 0 | |
| 2.379.0 | 0 / 0 | |
| 2.378.0 | 0 / 0 | |
| 2.377.6 | 0 / 0 | |
| 2.377.5 | 0 / 0 | |
| 2.377.4 | 0 / 0 | |
| 2.377.3 | 0 / 0 | |
| 2.377.2 | 0 / 0 | |
| 2.377.0 | 0 / 0 | |
| 2.376.6 | 0 / 0 | |
| 2.376.5 | 0 / 0 | |
| 2.376.4 | 0 / 0 | |
| 2.376.2 | 0 / 0 | |
| 2.376.1 | 0 / 0 | |
| 2.376.0 | 0 / 0 | |
| 2.375.1 | 0 / 0 | |
| 2.375.0 | 0 / 0 | |
| 2.374.5 | 0 / 0 | |
| 2.374.4 | 0 / 0 | |
| 2.374.2 | 0 / 0 | |
| 2.374.1 | 0 / 0 | |
| 2.374.0 | 0 / 0 | |
| 2.373.0 | 0 / 0 | |
| 2.372.17 | 0 / 0 | |
| 2.372.16 | 0 / 0 | |
| 2.372.15 | 0 / 0 | |
| 2.372.14 | 0 / 0 | |
| 2.372.13 | 0 / 0 | |
| 2.372.12 | 0 / 0 | |
| 2.372.11 | 0 / 0 | |
| 2.372.10 | 0 / 0 | |
| 2.372.9 | 0 / 0 | |
| 2.372.8 | 0 / 0 | |
| 2.372.7 | 0 / 0 | |
| 2.372.6 | 0 / 0 | |
| 2.372.5 | 0 / 0 | |
| 2.372.4 | 0 / 0 | |
| 2.372.3 | 0 / 0 | |
| 2.372.2 | 0 / 0 | |
| 2.372.1 | 0 / 0 | |
| 2.372.0 | 0 / 0 | |
| 2.371.3 | 0 / 0 | |
| 2.371.2 | 0 / 0 | |
| 2.371.1 | 0 / 0 | |
| 2.371.0 | 0 / 0 | |
| 2.370.1 | 0 / 0 | |
| 2.370.0 | 0 / 0 | |
| 2.369.1 | 0 / 0 | |
| 2.369.0 | 0 / 0 |
v2.393.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.393.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.392.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.391.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.390.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.