@bigbinary/neeto-commons-frontend
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/cjs/lodash-D5cnLa2T.js | AI (source-diff): Standard lodash 4.17.23 CJS bundle in dist output; canonical MIT-licensed library, not malware. | ai | |
| source-diff | net-exec-file:dist/lodash-DUiF2pG-.js | AI (source-diff): Standard lodash 4.17.23 bundle in dist output; canonical MIT-licensed library, not malware. | ai | |
| source-diff | net-exec-file:dist/lodash-DLwQ1MG1.js | AI (source-diff): Canonical lodash 4.17.23 bundled into dist; dynamic code execution is lodash's template/Function internals, not malware. | ai | |
| source-diff | net-exec-file:dist/cjs/lodash-Cj5Dn9eh.js | AI (source-diff): CJS variant of the same lodash 4.17.23 bundle; same false-positive rationale. | ai | |
| source-diff | net-exec-file:dist/lodash-BE1wh9Io.js | AI (source-diff): Bundled lodash 4.17.23 with canonical MIT header; not malware. | ai | |
| source-diff | net-exec-file:dist/cjs/lodash-CAzW54WT.js | AI (source-diff): CJS variant of bundled lodash 4.17.23; same false-positive pattern. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same bundle-analyzer browser-open pattern; not a reverse shell or miner. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in ESLint config helper to load user config files; documented plugin-loader pattern. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reads process.env to create esbuild define mappings (webpack-style); standard build-tool pattern, not exfiltration. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used only for bundle-analyzer open and execSync in build config utilities; stable false positive for this package. | ai | |
| semgrep | semgrep:silent-process-exec | AI (semgrep): Opens bundle analyzer HTML report in browser via platform open/start command; benign build-tool pattern stable across versions. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 4.13.130 | 0 / 144 | |
| 4.13.129 | 0 / 144 | |
| 4.13.128 | 0 / 144 | |
| 4.13.127 | 0 / 144 | |
| 4.13.126 | 0 / 144 | |
| 4.13.125 | 0 / 144 | |
| 4.13.124 | 0 / 144 | |
| 4.13.123 | 0 / 144 | |
| 4.13.122 | 0 / 144 | |
| 4.13.121 | 0 / 143 | |
| 4.13.120 | 0 / 143 | |
| 4.13.119 | 0 / 143 | |
| 4.13.118 | 0 / 143 | |
| 4.13.117 | 0 / 143 | |
| 4.13.116 | 0 / 143 | |
| 4.13.115 | 0 / 143 | |
| 4.13.114 | 0 / 142 | |
| 4.13.113 | 0 / 142 | |
| 4.13.112 | 0 / 142 | |
| 4.13.111 | 0 / 142 | |
| 4.13.110 | 0 / 142 | |
| 4.13.109 | 0 / 141 | |
| 4.13.108 | 0 / 141 | |
| 4.13.107 | 0 / 141 | |
| 4.13.106 | 0 / 141 | |
| 4.13.105 | 0 / 141 | |
| 4.13.104 | 0 / 141 | |
| 4.13.103 | 0 / 140 | |
| 4.13.102 | 0 / 140 | |
| 4.13.101 | 0 / 140 | |
| 4.13.100 | 0 / 140 | |
| 4.13.99 | 0 / 140 | |
| 4.13.98 | 0 / 140 | |
| 4.13.97 | 0 / 140 | |
| 4.13.96 | 0 / 140 | |
| 4.13.95 | 0 / 139 | |
| 4.13.94 | 0 / 139 | |
| 4.13.93 | 0 / 139 | |
| 4.13.92 | 0 / 137 | |
| 4.13.91 | 0 / 137 | |
| 4.13.90 | 0 / 137 | |
| 4.13.89 | 0 / 137 | |
| 4.13.88 | 0 / 137 |
v4.13.130
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.129
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.128
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.127
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.126
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.125
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.124
3 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Silent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.123
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.122
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.121
3 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Silent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.120
3 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Silent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.119
3 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Silent detached process — runs invisibly in the background (reverse shells, miners) 52 | 53 | const command = process.platform === "win32" ? "start" : "open"; > 54 | spawn(command, [htmlFilePath], { detached: true, stdio: "ignore" }); 55 | console.info( 56 | `${consoleColors.success}[bundle-analyzer]${consoleColors.reset} Bundle report opened in browser`
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.118
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.117
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.116
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.115
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.114
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.113
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.112
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.111
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.110
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.109
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.108
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.107
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.106
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.105
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.104
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.103
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.102
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.101
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.100
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.99
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.98
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.97
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.96
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.95
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.94
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.93
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.92
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.91
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.90
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.89
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.88
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.