@biocrypt/private-chat
Self-hostable, zero-dep private DNA-chat: ships a WebSocket relay + minimal browser UI. Everything (relay URL, room id, host public key) rides inside a single base64url link fragment. The server never sees plaintext.
12
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
zbiocrypt
Keywords
biocryptchatprivatewebsocketrelayend-to-end-encryptiondnarsaephemeralzero-dependency
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:static/assets/index-8gf1jwOp.js | AI (source-diff): Standard Vite/React minified bundle for the package's browser UI; expected artifact for this package. | ai | |
| source-diff | obfuscated-file:static/assets/index-DA6mqNYk.js | AI (source-diff): This is a Vite-bundled React frontend UI. The code sample shows standard React module initialization. Minified frontend bundles are expected for this package's browser UI component. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Package explicitly encodes/decodes base64url link fragments as its core feature; the flagged code is a standard base64url decode utility with no dynamic execution or exfiltration. | ai |