@classytic/arc — Greenflagged

Resource-oriented backend framework for Fastify — clean, minimal, powerful, tree-shakable

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

siam923classytic-bot

Keywords

fastifymongodbmongoosecrudrestapiframeworkresourcemulti-tenanttypescripttree-shakableserverlesswebsocketjobsworkflow

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/index-C000faom.d.mts	AI (source-diff): File is a bundled TypeScript declaration (.d.mts); long lines are normal for generated type rollups, not obfuscation.	ai	2026/05/31
source-diff	obfuscated-file:dist/index-C_bgx9o4.d.mts	AI (source-diff): TypeScript .d.mts declaration file with long type lines, not obfuscation; stable for this package.	ai	2026/05/30
source-diff	obfuscated-file:dist/index-C1JSBan-.d.mts	AI (source-diff): Long-line flag fires on bundled TypeScript declaration file; content is readable type definitions, not obfuscation.	ai	2026/05/29
source-diff	net-exec-file:dist/createApp-B_nvKNAQ.mjs	AI (source-diff): File is a Fastify app factory with security config; no actual dynamic code execution or network exfiltration present.	ai	2026/05/25
source-diff	obfuscated-file:dist/index-Cm0vUrr_.d.mts	AI (source-diff): File is a bundled TypeScript declaration rollup (.d.mts); long lines are normal for declaration bundles, not obfuscation.	ai	2026/05/25
source-diff	obfuscated-file:dist/index-6u4_Gg6G.d.mts	AI (source-diff): TypeScript .d.mts declaration file with long type lines, not obfuscation; stable for this package.	ai	2026/05/20
provenance	publisher-changed	AI (provenance): Transition from human account to org CI bot (classytic-bot); consistent with @classytic namespace.	ai	2026/05/20
source-diff	obfuscated-file:dist/interface-CMRutPfe.d.mts	AI (source-diff): File is a bundled TypeScript declaration file with long lines from concatenated type definitions, not obfuscated code.	ai	2026/05/20
source-diff	obfuscated-file:dist/index-DBDgy6Hw.d.mts	AI (source-diff): Long lines in .d.mts are bundled TypeScript declarations, not obfuscation; sample shows readable type definitions.	ai	2026/05/19
source-diff	encoded-string-file:dist/testing/index.js	AI (source-diff): Encoded string is @mongodb-js/saslprep's bundled Unicode code-points data (gzip+base64); stable false positive for this package.	ai	2026/05/03
source-diff	obfuscated-file:dist/interface-BVuMfeVv.d.mts	AI (source-diff): File is a bundled TypeScript declaration file; long lines are concatenated type definitions, not obfuscated code.	ai	2026/04/30
source-diff	obfuscated-file:dist/interface-CS6d7HiB.d.mts	AI (source-diff): File is a bundled TypeScript declaration file with long lines from concatenated type definitions, not obfuscated code.	ai	2026/04/30
source-diff	net-exec-file:dist/createApp-D2w0LdYJ.mjs	AI (source-diff): File is a Fastify app factory with security config; no dropper/loader behavior present.	ai	2026/04/30
typosquat	typosquat.levenshtein:ajv	AI (typosquat): Scoped @classytic/arc is a Fastify framework; name similarity to ajv is coincidental and not a typosquat.	ai	2026/04/29

Versions (showing 46 of 46)

Version	Deps	Published
2.18.2	3 / 45	2026-06-05
2.18.1	3 / 45	2026-05-29
2.18.0	3 / 45	2026-05-26
2.17.1	3 / 44	2026-05-25
2.17.0	3 / 44	2026-05-24
2.16.1	3 / 44	2026-05-18
2.16.0	3 / 44	2026-05-17
2.15.4	3 / 43	2026-05-10
2.15.3	3 / 43	2026-05-07
2.15.0	3 / 43	2026-05-07
2.14.2	3 / 43	2026-05-06
2.14.1	3 / 43	2026-05-05
2.14.0	3 / 43	2026-05-04
2.13.1	3 / 43	2026-05-04
2.11.4	3 / 42	2026-04-28
2.11.3	3 / 42	2026-04-27
2.11.2	3 / 41	2026-04-25
2.11.1	3 / 41	2026-04-25
2.11.0	3 / 41	2026-04-24
2.10.8	3 / 40	2026-04-22
2.10.3	3 / 40	2026-04-20
2.9.1	3 / 35	2026-04-17
2.8.5	3 / 34	2026-04-15
2.8.4	3 / 31	2026-04-14
2.8.3	3 / 31	2026-04-13
2.8.1	3 / 31	2026-04-12
2.8.0	3 / 30	2026-04-10
2.7.7	3 / 30	2026-04-09
2.7.3	3 / 29	2026-04-08
2.7.1	3 / 29	2026-04-08
2.6.3	3 / 21	2026-04-07
2.6.2	3 / 21	2026-04-07
2.6.1	3 / 21	2026-04-06
2.4.3	2 / 21	2026-04-03
2.4.2	2 / 20	2026-04-02
2.4.1	2 / 20	2026-04-01
2.3.0	2 / 18	2026-03-17
2.2.5	2 / 18	2026-03-11
2.2.0	2 / 18	2026-03-05
2.1.7	2 / 18	2026-03-03
2.1.3	2 / 18	2026-03-02
2.1.2	2 / 18	2026-03-01
1.1.0	2 / 12	2026-02-04
1.0.8	1 / 11	2026-01-29
1.0.5	1 / 11	2026-01-25
1.0.0	1 / 17	2026-01-21

v2.18.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.18.1

2 findings

HIGH New obfuscated file: dist/index-C000faom.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.18.0

2 findings

HIGH New obfuscated file: dist/index-C1JSBan-.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.17.1

2 findings

HIGH New obfuscated file: dist/index-C1JSBan-.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.17.0

2 findings

HIGH New obfuscated file: dist/index-C1JSBan-.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.1

2 findings

HIGH New obfuscated file: dist/index-DBDgy6Hw.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.1

3 findings

HIGH Publisher changed: siam923 → classytic-bot (on 2026-04-25) provenance

This version was published by a different npm account than previous versions on 2026-04-25. This could indicate a legitimate maintainer transition or an account compromise.

HIGH New obfuscated file: dist/index-C_bgx9o4.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.0

2 findings

HIGH New obfuscated file: dist/index-Cm0vUrr_.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.5

2 findings

HIGH New obfuscated file: dist/interface-CMRutPfe.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.4

2 findings

HIGH New obfuscated file: dist/interface-BVuMfeVv.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.3

2 findings

HIGH New obfuscated file: dist/interface-BVuMfeVv.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.1

2 findings

HIGH New obfuscated file: dist/interface-CS6d7HiB.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.1

2 findings

HIGH New file with network + code execution: dist/createApp-B_nvKNAQ.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.3

2 findings

HIGH New file with network + code execution: dist/createApp-D2w0LdYJ.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.2

2 findings

HIGH New file with network + code execution: dist/createApp-D2w0LdYJ.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

2 findings

HIGH Long encoded string in modified file: dist/testing/index.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.8

2 findings

HIGH Long encoded string in modified file: dist/testing/index.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.5

2 findings

HIGH Long encoded string in modified file: dist/testing/index.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.