@bigbinary/neeto-commons-frontend
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/cjs/lodash-D5cnLa2T.js | AI (source-diff): Standard lodash 4.17.23 CJS bundle in dist output; canonical MIT-licensed library, not malware. | ai | |
| source-diff | net-exec-file:dist/lodash-DUiF2pG-.js | AI (source-diff): Standard lodash 4.17.23 bundle in dist output; canonical MIT-licensed library, not malware. | ai | |
| source-diff | net-exec-file:dist/lodash-DLwQ1MG1.js | AI (source-diff): Canonical lodash 4.17.23 bundled into dist; dynamic code execution is lodash's template/Function internals, not malware. | ai | |
| source-diff | net-exec-file:dist/cjs/lodash-Cj5Dn9eh.js | AI (source-diff): CJS variant of the same lodash 4.17.23 bundle; same false-positive rationale. | ai | |
| source-diff | net-exec-file:dist/lodash-BE1wh9Io.js | AI (source-diff): Bundled lodash 4.17.23 with canonical MIT header; not malware. | ai | |
| source-diff | net-exec-file:dist/cjs/lodash-CAzW54WT.js | AI (source-diff): CJS variant of bundled lodash 4.17.23; same false-positive pattern. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same bundle-analyzer browser-open pattern; not a reverse shell or miner. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in ESLint config helper to load user config files; documented plugin-loader pattern. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reads process.env to create esbuild define mappings (webpack-style); standard build-tool pattern, not exfiltration. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used only for bundle-analyzer open and execSync in build config utilities; stable false positive for this package. | ai | |
| semgrep | semgrep:silent-process-exec | AI (semgrep): Opens bundle analyzer HTML report in browser via platform open/start command; benign build-tool pattern stable across versions. | ai |
Versions (showing 100 of 112)
| Version | Deps | Published |
|---|---|---|
| 4.13.150 | 0 / 146 | |
| 4.13.149 | 0 / 146 | |
| 4.13.148 | 0 / 146 | |
| 4.13.147 | 0 / 146 | |
| 4.13.146 | 0 / 146 | |
| 4.13.145 | 0 / 146 | |
| 4.13.144 | 0 / 145 | |
| 4.13.143 | 0 / 145 | |
| 4.13.142 | 0 / 145 | |
| 4.13.141 | 0 / 145 | |
| 4.13.140 | 0 / 145 | |
| 4.13.139 | 0 / 145 | |
| 4.13.138 | 0 / 144 | |
| 4.13.137 | 0 / 144 | |
| 4.13.136 | 0 / 144 | |
| 4.13.135 | 0 / 144 | |
| 4.13.134 | 0 / 144 | |
| 4.13.133 | 0 / 144 | |
| 4.13.132 | 0 / 144 | |
| 4.13.131 | 0 / 144 | |
| 4.13.130 | 0 / 144 | |
| 4.13.129 | 0 / 144 | |
| 4.13.128 | 0 / 144 | |
| 4.13.127 | 0 / 144 | |
| 4.13.126 | 0 / 144 | |
| 4.13.125 | 0 / 144 | |
| 4.13.124 | 0 / 144 | |
| 4.13.123 | 0 / 144 | |
| 4.13.122 | 0 / 144 | |
| 4.13.121 | 0 / 143 | |
| 4.13.120 | 0 / 143 | |
| 4.13.119 | 0 / 143 | |
| 4.13.118 | 0 / 143 | |
| 4.13.117 | 0 / 143 | |
| 4.13.116 | 0 / 143 | |
| 4.13.115 | 0 / 143 | |
| 4.13.114 | 0 / 142 | |
| 4.13.113 | 0 / 142 | |
| 4.13.112 | 0 / 142 | |
| 4.13.111 | 0 / 142 | |
| 4.13.110 | 0 / 142 | |
| 4.13.109 | 0 / 141 | |
| 4.13.108 | 0 / 141 | |
| 4.13.107 | 0 / 141 | |
| 4.13.106 | 0 / 141 | |
| 4.13.105 | 0 / 141 | |
| 4.13.104 | 0 / 141 | |
| 4.13.103 | 0 / 140 | |
| 4.13.102 | 0 / 140 | |
| 4.13.101 | 0 / 140 | |
| 4.13.100 | 0 / 140 | |
| 4.13.99 | 0 / 140 | |
| 4.13.98 | 0 / 140 | |
| 4.13.97 | 0 / 140 | |
| 4.13.96 | 0 / 140 | |
| 4.13.95 | 0 / 139 | |
| 4.13.94 | 0 / 139 | |
| 4.13.93 | 0 / 139 | |
| 4.13.92 | 0 / 137 | |
| 4.13.91 | 0 / 137 | |
| 4.13.90 | 0 / 137 | |
| 4.13.89 | 0 / 137 | |
| 4.13.88 | 0 / 137 | |
| 4.13.87 | 0 / 139 | |
| 4.13.86 | 0 / 145 | |
| 4.13.85 | 0 / 145 | |
| 4.13.84 | 0 / 145 | |
| 4.13.30 | 0 / 136 | |
| 4.13.29 | 0 / 136 | |
| 4.13.28 | 0 / 136 | |
| 4.13.27 | 0 / 136 | |
| 4.13.26 | 0 / 136 | |
| 4.13.25 | 0 / 136 | |
| 4.13.24 | 0 / 136 | |
| 4.13.23 | 0 / 136 | |
| 4.13.22 | 0 / 136 | |
| 4.13.21 | 0 / 136 | |
| 4.13.20 | 0 / 136 | |
| 4.13.19 | 0 / 136 | |
| 4.13.18 | 0 / 136 | |
| 4.13.17 | 0 / 136 | |
| 4.13.16 | 0 / 136 | |
| 4.13.15 | 0 / 136 | |
| 4.13.14 | 0 / 136 | |
| 4.13.13 | 0 / 136 | |
| 4.13.12 | 0 / 136 | |
| 4.13.11 | 0 / 136 | |
| 4.13.10 | 0 / 136 | |
| 4.13.9 | 0 / 136 | |
| 4.13.8 | 0 / 136 | |
| 4.13.7 | 0 / 136 | |
| 4.13.6 | 0 / 136 | |
| 4.13.5 | 0 / 136 | |
| 4.13.4 | 0 / 136 | |
| 4.13.3 | 0 / 134 | |
| 4.13.2 | 0 / 133 | |
| 4.13.1 | 0 / 133 | |
| 4.12.6 | 0 / 127 | |
| 4.12.5 | 0 / 126 | |
| 4.12.4 | 0 / 126 |
v4.13.150
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.149
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.148
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.147
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.146
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.145
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.144
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.143
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.142
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.141
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.140
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.139
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.13.87
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.86
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.85
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.84
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.13.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.12.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.12.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.12.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.