← Home

@boostxyz/sdk

Typescript devkit for interacting with the Boost V2 Protocol

23
Versions
GPL-3.0-or-later
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

jamieboostquaziasammccordmmackzjon-boost

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/Budget-BjfL8dVX.cjs AI (source-diff): Contains embedded EVM contract bytecode hex, not JS obfuscation; standard for Web3 SDK bundles. ai
source-diff obfuscated-file:dist/generated-CkZm1EVH.cjs AI (source-diff): Bundled wagmi/viem re-export file. ai
source-diff obfuscated-file:dist/deployments-DlN-f7oW.cjs AI (source-diff): Contract address constants table, not obfuscation. ai
source-diff obfuscated-file:dist/Budget-CsOc5UQe.cjs AI (source-diff): Bundled JS with embedded contract bytecode hex, not obfuscation. ai
source-diff obfuscated-file:dist/AllowList-5E4YwWg0.cjs AI (source-diff): Bundled JS with embedded contract bytecode hex, not obfuscation. ai
source-diff obfuscated-file:dist/Budget-DGPItPqt.js AI (source-diff): Bundled JS with embedded EVM contract bytecode constant, not obfuscation. ai
source-diff obfuscated-file:dist/deployments-CaacquP1.cjs AI (source-diff): Static deployment-address map, minified, not obfuscated. ai
source-diff obfuscated-file:dist/generated-BOBQ2ut4.cjs AI (source-diff): Bundled wagmi/viem re-export, standard minified vendor code. ai
source-diff obfuscated-file:dist/Budget-DGg1wCa6.cjs AI (source-diff): Bundled build output containing embedded EVM contract bytecode, not JS obfuscation. ai
source-diff obfuscated-file:dist/Budget-2xKEvkbL.cjs AI (source-diff): Bundled build output containing embedded EVM contract bytecode, not JS obfuscation. ai
source-diff obfuscated-file:dist/Budget-AoNx7uFd.cjs AI (source-diff): Bundled output embedding Solidity bytecode hex constants, not obfuscated JS. ai
source-diff obfuscated-file:dist/Budget-Cnyh81n5.cjs AI (source-diff): Bundled Solidity bytecode constant + minified JS, not true obfuscation. ai
source-diff obfuscated-file:dist/SimpleDenyList-GZlSeh2G.js AI (source-diff): Bundled Solidity bytecode + minified JS. ai
source-diff obfuscated-file:dist/Incentive-M45PaQsT.js AI (source-diff): Bundled Solidity bytecode + minified JS. ai
source-diff obfuscated-file:dist/Budget-fHCvlPfB.js AI (source-diff): Bundled Solidity bytecode + minified JS. ai
source-diff obfuscated-file:dist/SimpleDenyList-CgQvS1ek.cjs AI (source-diff): Bundled Solidity bytecode + minified JS. ai
source-diff obfuscated-file:dist/Incentive-axLU7ndr.cjs AI (source-diff): Bundled Solidity bytecode + minified JS. ai
source-diff obfuscated-file:dist/generated-CNkDfjzI.cjs AI (source-diff): Bundled wagmi/viem code, minified build output. ai
source-diff obfuscated-file:dist/deployments-CMdsItcq.cjs AI (source-diff): Static contract-address map, minified build output. ai
source-diff obfuscated-file:dist/Budget-BA_1sa1e.cjs AI (source-diff): Bundled JS containing compiled Solidity bytecode hex constant, not JS obfuscation. ai
source-diff obfuscated-file:dist/SimpleDenyList-BKfPoTo1.js AI (source-diff): ESM bundled output. ai
source-diff obfuscated-file:dist/Incentive-DCOhfsid.js AI (source-diff): ESM bundled output. ai
source-diff obfuscated-file:dist/Budget-JjYzHgRx.js AI (source-diff): ESM bundled output, same pattern as cjs sibling. ai
source-diff obfuscated-file:dist/SimpleDenyList-DgjVf7FK.cjs AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/Incentive-BHOurMJr.cjs AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/deployments-CwTZr-cK.cjs AI (source-diff): Static chain-address lookup table, minified build output. ai
source-diff obfuscated-file:dist/Budget-Dm6h8giH.cjs AI (source-diff): Bundled output embedding compiled contract bytecode, not JS obfuscation. ai
source-diff obfuscated-file:dist/AllowList-BJ9HQGFs.cjs AI (source-diff): Bundled JS embedding contract bytecode hex strings, not real obfuscation. ai
source-diff obfuscated-file:dist/Budget-D_zhh1rh.cjs AI (source-diff): Same bundled/bytecode pattern as sibling dist files. ai
source-diff obfuscated-file:dist/deployments-BjBgk03b.cjs AI (source-diff): Static contract address map, not obfuscation. ai
source-diff obfuscated-file:dist/generated-dd4FN0Fo.cjs AI (source-diff): Bundled wagmi/viem re-export, build output. ai
maintainer-change maintainer-added AI (maintainer-change): Consistent with documented team transition, publisher has strong track record. ai
source-diff obfuscated-file:dist/Budget-N0YEfSt2.cjs AI (source-diff): Bundled EVM contract bytecode constant, not code obfuscation. ai
source-diff obfuscated-file:dist/Incentive-DZLG6T1-.js AI (source-diff): Vite-bundled ESM output with embedded bytecode. ai
source-diff obfuscated-file:dist/Incentive-DvNdIJ_x.cjs AI (source-diff): Bundled build output with embedded contract bytecode. ai
source-diff encoded-string-file:dist/BoostCore.cjs AI (source-diff): Long string is EVM contract bytecode hex literal, standard for this on-chain SDK. ai
source-diff obfuscated-file:dist/Budget-DpQgIZEx.js AI (source-diff): Bundled dist file containing contract bytecode hex constants, not obfuscated JS logic. ai
source-diff obfuscated-file:dist/Incentive-Bkq1kdns.cjs AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/generated-BPiHi7W2.cjs AI (source-diff): Vite-bundled vendor code (wagmi/viem), minified not obfuscated. ai
source-diff obfuscated-file:dist/Budget-CsqSI4NH.cjs AI (source-diff): Bundled output containing embedded EVM contract bytecode, not JS obfuscation. ai
source-diff obfuscated-file:dist/deployments-CIXw_WKk.cjs AI (source-diff): Bundled deployment address map, not obfuscation. ai
source-diff obfuscated-file:dist/SimpleDenyList-C734XLxt.js AI (source-diff): Bundled ESM output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/Incentive-D_NHLasu.js AI (source-diff): Bundled ESM output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/Budget-bMiAGF8s.js AI (source-diff): Bundled ESM output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/SimpleDenyList-BAIrFBAW.cjs AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/deployments-B1Mh8zRA.cjs AI (source-diff): Bundled deployment-address map, long lines from minification. ai
source-diff obfuscated-file:dist/SimpleDenyList-bCzbBEvY.js AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/Incentive-o0qXIACU.js AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/Budget-C3eMp8lh.js AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/SimpleDenyList-Dzs_F7dt.cjs AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/Incentive-BWC9nRgY.cjs AI (source-diff): Bundled output with embedded contract bytecode. ai
source-diff obfuscated-file:dist/generated-DAZo6jo9.cjs AI (source-diff): Bundled @wagmi/core re-export, minified build output. ai
source-diff obfuscated-file:dist/Budget-BSqx3xcT.cjs AI (source-diff): Bundled output embedding compiled contract bytecode, not JS obfuscation. ai
source-diff obfuscated-file:dist/Budget-uGKa2qzz.cjs AI (source-diff): Bundled output containing embedded contract bytecode, not obfuscation. ai
maintainer-change maintainer-removed AI (maintainer-change): Long-tenured single publisher with clean track record; routine team change. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Local hardhat test fixture, not a real network target. ai
source-diff obfuscated-file:dist/Budget-NtzY9H7G.js AI (source-diff): Same bytecode constant in ESM build. ai
source-diff obfuscated-file:dist/SimpleDenyList-B65fnca2.cjs AI (source-diff): Contract bytecode constant embedded in bundle. ai
source-diff obfuscated-file:dist/generated-pNKCp_Ez.cjs AI (source-diff): Bundled @wagmi/core vendor code. ai
source-diff obfuscated-file:dist/SimpleDenyList-UvXQl2vm.js AI (source-diff): Same bytecode constant in ESM build. ai
bogus-package bogus-package AI (bogus-package): SDK package with docs elsewhere; not spam. ai
source-diff obfuscated-file:dist/Budget-B0kJsZtZ.cjs AI (source-diff): Bundled contract bytecode constant, not JS obfuscation. ai
source-diff obfuscated-file:dist/deployments-DxkwtCyu.cjs AI (source-diff): Static deployment address map, minified build output. ai

Versions (showing 23 of 23)

Show 14 prereleases
Version Deps Published
8.0.0 1 / 0
7.8.0 1 / 0
7.7.0 1 / 0
7.5.1 1 / 0
7.3.0 1 / 0
7.1.0 1 / 0
7.0.0 1 / 0
6.1.3 1 / 0
6.1.1 1 / 0
6.1.0 1 / 0
6.0.3 1 / 0
6.0.2 1 / 0
6.0.1 1 / 0
5.3.0 1 / 0
5.1.1 1 / 0
5.0.0 1 / 0
3.0.0 1 / 0
2.2.2 1 / 0
2.2.1 1 / 0
2.2.0 1 / 0
2.1.1 1 / 0
2.1.0 1 / 0
2.0.0 1 / 0

v8.0.0

44 findings
HIGH Publisher changed: sammccord → jon-boost (on 2025-12-05) provenance

This version was published by a different npm account than previous versions on 2025-12-05. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/AllowList-5E4YwWg0.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-CsOc5UQe.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-DlN-f7oW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-CkZm1EVH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CcgYNFRy.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/LimitedSignerValidatorV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/PayableLimitedSignerValidator.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/PayableLimitedSignerValidatorV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/SignerValidatorV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-3RWW58zH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/AllowList-CEZesjn_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-BJ2IQkPq.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DRQttkJy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/LimitedSignerValidatorV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/PayableLimitedSignerValidator.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/PayableLimitedSignerValidatorV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validators/SignerValidatorV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-OdQKzde5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.8.0

40 findings
HIGH Publisher changed: sammccord → jon-boost (on 2025-08-27) provenance

This version was published by a different npm account than previous versions on 2025-08-27. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/AllowList-BJ9HQGFs.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-D_zhh1rh.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-BjBgk03b.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-dd4FN0Fo.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CrnbYN_a.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-7-VTqfsH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validator-rYW7PMwW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/AllowList-DiU7g4Hs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-YIhV65cc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CeoEla-t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-Dr03aOeP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validator-DgvB9wge.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.7.0

40 findings
HIGH Publisher changed: sammccord → jon-boost (on 2025-08-05) provenance

This version was published by a different npm account than previous versions on 2025-08-05. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/AllowList-BJ9HQGFs.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-D_zhh1rh.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-BjBgk03b.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-dd4FN0Fo.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CrnbYN_a.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-7-VTqfsH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validator-rYW7PMwW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/AllowList-DiU7g4Hs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-YIhV65cc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CeoEla-t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-Dr03aOeP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validator-DgvB9wge.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.5.1

38 findings
HIGH Publisher changed: sammccord → jon-boost (on 2025-07-08) provenance

This version was published by a different npm account than previous versions on 2025-07-08. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/Budget-DGg1wCa6.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CaacquP1.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BOBQ2ut4.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Ckxpw7EN.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-v5G-fPfm.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validator-BA8RC2J6.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-ZnzzZsjK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CYj6lbM5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-DUO4ex__.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Validator-D4CzwdB9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.3.0

35 findings
HIGH New obfuscated file: dist/Budget-uGKa2qzz.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-Dk-Z1L2X.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-C_JEoLDO.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Dufx0ZjH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-B2YDJ_gk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-B-grnRq9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Bz_g-nID.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BlLgvhjE.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.1.0

35 findings
HIGH New obfuscated file: dist/Budget-uGKa2qzz.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-Dk-Z1L2X.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-C_JEoLDO.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Dufx0ZjH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-B2YDJ_gk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-B-grnRq9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Bz_g-nID.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BlLgvhjE.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.0.0

35 findings
HIGH New obfuscated file: dist/Budget-uGKa2qzz.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-Dk-Z1L2X.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-C_JEoLDO.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Dufx0ZjH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-B2YDJ_gk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-B-grnRq9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentive.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20PeggedVariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentives/ERC20VariableCriteriaIncentiveV2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Bz_g-nID.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BlLgvhjE.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.3

29 findings
HIGH New obfuscated file: dist/Budget-BjfL8dVX.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CwTZr-cK.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BPiHi7W2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-gVTfsnMB.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-DgjVf7FK.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-DD7IPuDx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-V1RjH38L.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BKfPoTo1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.1

29 findings
HIGH New obfuscated file: dist/Budget-Dm6h8giH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CwTZr-cK.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BPiHi7W2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-BHOurMJr.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-DgjVf7FK.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-JjYzHgRx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DCOhfsid.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BKfPoTo1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.0

29 findings
HIGH New obfuscated file: dist/Budget-CsqSI4NH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CIXw_WKk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BPiHi7W2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Bkq1kdns.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BAIrFBAW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-bMiAGF8s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-D_NHLasu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-C734XLxt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.3

29 findings
HIGH New obfuscated file: dist/Budget-CsqSI4NH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CIXw_WKk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BPiHi7W2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Bkq1kdns.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BAIrFBAW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-bMiAGF8s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-D_NHLasu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-C734XLxt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.2

29 findings
HIGH New obfuscated file: dist/Budget-CsqSI4NH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CIXw_WKk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BPiHi7W2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DvNdIJ_x.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BAIrFBAW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-bMiAGF8s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DZLG6T1-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-C734XLxt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.1

29 findings
HIGH New obfuscated file: dist/Budget-CsqSI4NH.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CIXw_WKk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-BPiHi7W2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DvNdIJ_x.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BAIrFBAW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-bMiAGF8s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DZLG6T1-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-C734XLxt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.3.0

29 findings
HIGH New obfuscated file: dist/Budget-AoNx7uFd.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-DoIOqxco.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-DtYPHhtX.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-BbkfwGOb.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-CsRXJPwm.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-DYIV9iNK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-qlnv5kQB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-ByAr4X1r.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.1

29 findings
HIGH New obfuscated file: dist/Budget-N0YEfSt2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-BGpr4ppG.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-CRD9XfOT.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-lNp-ZudZ.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-DIb4xX3j.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-C0SMvfEl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DSsxOFKY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-B8QeJthf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.0

30 findings
HIGH New obfuscated file: dist/Budget-Cnyh81n5.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-CMdsItcq.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-CNkDfjzI.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-axLU7ndr.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-CgQvS1ek.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-fHCvlPfB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-M45PaQsT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-GZlSeh2G.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

30 findings
HIGH New obfuscated file: dist/Budget-Dw3jHqDC.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-C7-jUofW.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-DAZo6jo9.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-BNm7fgJh.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-S6braCCk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-DGPItPqt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-Dxw1wwbl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-CUvdsCvZ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.2

30 findings
HIGH New obfuscated file: dist/Budget-BSqx3xcT.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-B1Mh8zRA.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-DAZo6jo9.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-BWC9nRgY.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-Dzs_F7dt.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-C3eMp8lh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-o0qXIACU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-bCzbBEvY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

30 findings
HIGH New obfuscated file: dist/Budget-2xKEvkbL.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-BucJ-gwk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-D50hBWtr.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-CfIjdL4T.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-BQ0GqQfC.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-2Zb3Mb-8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Incentive-DNwTyG5Z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-D49GF3NX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

28 findings
HIGH New obfuscated file: dist/Budget-BA_1sa1e.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-BucJ-gwk.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-CgBgbMNe.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-DrQrJ14i.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-B0q1S08L.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-DuCoaOlG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:141 semgrep

HTTP request to raw IP address — legitimate packages use domain names 139 | 140 | const walletClient = createTestClient({ > 141 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 142 | chain: hardhat, 143 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:192 semgrep

HTTP request to raw IP address — legitimate packages use domain names 190 | // Create new options with new owner's account and wallet client 191 | const walletClient = createTestClient({ > 192 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 193 | chain: hardhat, 194 | mode: 'hardhat',

HIGH shady-links-raw-ip: src/Deployable/DeployableTargetWithRBAC.test.ts:232 semgrep

HTTP request to raw IP address — legitimate packages use domain names 230 | 231 | const walletClient = createTestClient({ > 232 | transport: http('http://127.0.0.1:8545', { retryCount: 0 }), 233 | chain: hardhat, 234 | mode: 'hardhat',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

29 findings
HIGH New obfuscated file: dist/Budget-BxQMnsdx.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-BDumesUK.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-CA24drhL.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-DpQgIZEx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-UHgnaOb_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

25 findings
HIGH New obfuscated file: dist/Budget-B0kJsZtZ.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/deployments-DxkwtCyu.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/generated-pNKCp_Ez.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-B65fnca2.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/Budget-NtzY9H7G.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/SimpleDenyList-UvXQl2vm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20Incentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableCriteriaIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/ERC20VariableIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Actions/EventAction.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/LimitedSignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Budgets/ManagedBudget.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Auth/PassthroughAuth.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/PointsIncentive.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Validators/SignerValidator.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/AllowLists/SimpleAllowList.cjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/AllowListIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostCore.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/BoostRegistry.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/Incentives/CGDAIncentive.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.