@bigbinary/neeto-commons-frontend
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/cjs/lodash-D5cnLa2T.js | AI (source-diff): Standard lodash 4.17.23 CJS bundle in dist output; canonical MIT-licensed library, not malware. | ai | |
| source-diff | net-exec-file:dist/lodash-DUiF2pG-.js | AI (source-diff): Standard lodash 4.17.23 bundle in dist output; canonical MIT-licensed library, not malware. | ai | |
| source-diff | net-exec-file:dist/lodash-DLwQ1MG1.js | AI (source-diff): Canonical lodash 4.17.23 bundled into dist; dynamic code execution is lodash's template/Function internals, not malware. | ai | |
| source-diff | net-exec-file:dist/cjs/lodash-Cj5Dn9eh.js | AI (source-diff): CJS variant of the same lodash 4.17.23 bundle; same false-positive rationale. | ai | |
| source-diff | net-exec-file:dist/lodash-BE1wh9Io.js | AI (source-diff): Bundled lodash 4.17.23 with canonical MIT header; not malware. | ai | |
| source-diff | net-exec-file:dist/cjs/lodash-CAzW54WT.js | AI (source-diff): CJS variant of bundled lodash 4.17.23; same false-positive pattern. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same bundle-analyzer browser-open pattern; not a reverse shell or miner. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in ESLint config helper to load user config files; documented plugin-loader pattern. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reads process.env to create esbuild define mappings (webpack-style); standard build-tool pattern, not exfiltration. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used only for bundle-analyzer open and execSync in build config utilities; stable false positive for this package. | ai | |
| semgrep | semgrep:silent-process-exec | AI (semgrep): Opens bundle analyzer HTML report in browser via platform open/start command; benign build-tool pattern stable across versions. | ai |
Versions (showing 51 of 112)
| Version | Deps | Published |
|---|---|---|
| 4.13.150 | 0 / 146 | |
| 4.13.149 | 0 / 146 | |
| 4.13.148 | 0 / 146 | |
| 4.13.147 | 0 / 146 | |
| 4.13.146 | 0 / 146 | |
| 4.13.145 | 0 / 146 | |
| 4.13.144 | 0 / 145 | |
| 4.13.143 | 0 / 145 | |
| 4.13.142 | 0 / 145 | |
| 4.13.141 | 0 / 145 | |
| 4.13.140 | 0 / 145 | |
| 4.13.139 | 0 / 145 | |
| 4.13.138 | 0 / 144 | |
| 4.13.137 | 0 / 144 | |
| 4.13.136 | 0 / 144 | |
| 4.13.135 | 0 / 144 | |
| 4.13.134 | 0 / 144 | |
| 4.13.133 | 0 / 144 | |
| 4.13.132 | 0 / 144 | |
| 4.13.131 | 0 / 144 | |
| 4.13.130 | 0 / 144 | |
| 4.13.129 | 0 / 144 | |
| 4.13.128 | 0 / 144 | |
| 4.13.127 | 0 / 144 | |
| 4.13.126 | 0 / 144 | |
| 4.13.125 | 0 / 144 | |
| 4.13.124 | 0 / 144 | |
| 4.13.123 | 0 / 144 | |
| 4.13.122 | 0 / 144 | |
| 4.13.121 | 0 / 143 | |
| 4.13.120 | 0 / 143 | |
| 4.13.119 | 0 / 143 | |
| 4.13.118 | 0 / 143 | |
| 4.13.117 | 0 / 143 | |
| 4.13.116 | 0 / 143 | |
| 4.13.115 | 0 / 143 | |
| 4.13.114 | 0 / 142 | |
| 4.13.113 | 0 / 142 | |
| 4.13.112 | 0 / 142 | |
| 4.13.111 | 0 / 142 | |
| 4.13.110 | 0 / 142 | |
| 4.13.109 | 0 / 141 | |
| 4.13.108 | 0 / 141 | |
| 4.13.107 | 0 / 141 | |
| 4.13.106 | 0 / 141 | |
| 4.13.105 | 0 / 141 | |
| 4.13.104 | 0 / 141 | |
| 4.13.103 | 0 / 140 | |
| 4.13.102 | 0 / 140 | |
| 4.13.101 | 0 / 140 | |
| 4.13.100 | 0 / 140 |
v4.13.150
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.149
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.148
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.147
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.146
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.145
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.144
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.143
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.142
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.141
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.140
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.139
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.