@cloudbase/js-sdk
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:app/dist/index.node.js | AI (source-diff): Bundled SDK network client code, no fetched-binary exec. | ai | |
| source-diff | obfuscated-file:app/dist/index.node.js | AI (source-diff): Webpack-bundled SDK submodule matching package.json exports, not obfuscation. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Same org transition; yuzhen's track record supports legitimate maintainer addition. | ai | |
| provenance | publisher-changed | AI (provenance): New publisher yuzhen has strong track record (498 approved, 0 rejected); consistent with internal team handoff at TencentCloudBase. | ai | |
| source-diff | obfuscated-file:miniprogram_dist/apis.js | AI (source-diff): Standard webpack UMD bundle output; no true obfuscation (_0x/eval-atob/packer) present. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @cloudbase/apis is a same-org first-party dep matching the monorepo version; not a suspicious third-party addition. | ai | |
| source-diff | net-exec-file:miniprogram_dist/mysql.js | AI (source-diff): Network calls target user-configured CloudBase gateway endpoint; no unrelated exfil destination present. | ai | |
| source-diff | obfuscated-file:miniprogram_dist/mysql.js | AI (source-diff): Standard UMD/webpack bundle output, not true obfuscation; consistent with all other miniprogram_dist files in this package. | ai | |
| source-diff | obfuscated-file:utilities/dist/esm/helpers/decorators.js | AI (source-diff): Standard TypeScript compiler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:utilities/dist/cjs/libs/cache.js | AI (source-diff): Standard TypeScript compiler output (__extends/__awaiter/__generator helpers); not obfuscation. | ai | |
| source-diff | obfuscated-file:utilities/dist/esm/libs/cache.js | AI (source-diff): Standard TypeScript compiler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:utilities/dist/cjs/helpers/decorators.js | AI (source-diff): Standard TypeScript compiler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:utilities/dist/cjs/libs/events.js | AI (source-diff): Standard TypeScript compiler output; not obfuscation. | ai | |
| source-diff | obfuscated-file:utilities/dist/esm/libs/events.js | AI (source-diff): Standard TypeScript compiler output; not obfuscation. | ai | |
| phantom-deps | phantom-dep:regenerator-runtime | AI (phantom-deps): Known implicit/polyfill dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Config-only reference; stable false positive for this package. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): High-frequency org SDK with 361 versions; rapid successive publishes are normal for this package. | ai | |
| dependencies | unvetted-dep:@cloudbase/database | AI (dependencies): Internal @cloudbase org dependency; consistent with this SDK's architecture across versions. | ai | |
| dependencies | unvetted-dep:@cloudbase/adapter-interface | AI (dependencies): Internal @cloudbase org dependency; stable pattern across this package's release history. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decode in minified SDK bundle is a standard utility pattern, not malicious. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode in minified SDK bundle is expected for encoding/decoding data, not payload hiding. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires in minified bundle output; standard pattern in bundled SDK code, not malicious. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in minified bundle is a normal transpilation artifact, not evasion. | ai | |
| phantom-deps | phantom-dep:@cloudbase/utilities | AI (phantom-deps): Same-org scoped package; phantom-dep heuristic unreliable for monorepo sub-packages. | ai | |
| typosquat | typosquat.levenshtein:aws-sdk | AI (typosquat): @cloudbase/js-sdk is the official Tencent CloudBase SDK, not a typosquat of aws-sdk. | ai |
Versions (showing 51 of 166)
| Version | Deps | Published |
|---|---|---|
| 3.6.4 | 10 / 0 | |
| 3.6.2 | 10 / 0 | |
| 3.6.1 | 10 / 0 | |
| 3.6.0 | 9 / 0 | |
| 3.5.4 | 9 / 0 | |
| 3.5.3 | 9 / 0 | |
| 3.5.2 | 9 / 0 | |
| 3.5.1 | 9 / 0 | |
| 3.5.0 | 9 / 0 | |
| 3.4.8 | 9 / 0 | |
| 3.4.7 | 9 / 0 | |
| 3.4.5 | 24 / 0 | |
| 3.4.4 | 24 / 0 | |
| 3.4.3 | 23 / 0 | |
| 3.4.2 | 23 / 0 | |
| 3.4.1 | 23 / 0 | |
| 3.4.0 | 23 / 0 | |
| 3.3.13 | 15 / 0 | |
| 3.3.12 | 15 / 0 | |
| 3.3.11 | 15 / 0 | |
| 3.3.10 | 15 / 0 | |
| 3.3.9 | 15 / 0 | |
| 3.3.8 | 15 / 0 | |
| 3.3.7 | 15 / 0 | |
| 3.3.6 | 15 / 0 | |
| 3.3.5 | 15 / 0 | |
| 3.3.4 | 15 / 0 | |
| 3.3.3 | 15 / 0 | |
| 3.3.2 | 15 / 0 | |
| 3.3.1 | 15 / 0 | |
| 3.3.0 | 15 / 0 | |
| 3.2.2 | 15 / 0 | |
| 3.2.1 | 15 / 0 | |
| 3.2.0 | 15 / 0 | |
| 3.1.12 | 15 / 0 | |
| 3.1.11 | 15 / 0 | |
| 3.1.10 | 15 / 0 | |
| 3.1.9 | 15 / 0 | |
| 3.1.8 | 15 / 0 | |
| 3.1.6 | 15 / 0 | |
| 3.1.5 | 15 / 0 | |
| 3.1.4 | 15 / 0 | |
| 3.1.3 | 15 / 0 | |
| 3.1.1 | 15 / 0 | |
| 3.1.0 | 15 / 0 | |
| 3.0.4 | 15 / 0 | |
| 3.0.3 | 15 / 0 | |
| 3.0.2 | 15 / 0 | |
| 2.31.0 | 9 / 0 | |
| 2.30.0 | 9 / 0 | |
| 2.29.0 | 9 / 0 |
v3.6.4
23 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.2
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.1
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.2
2 findingsThis version was published by a different npm account than previous versions on 2026-04-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.1
2 findingsThis version was published by a different npm account than previous versions on 2026-03-24. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.2.0
3 findingsThis version was published by a different npm account than previous versions on 2026-03-23. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.12
2 findingsThis version was published by a different npm account than previous versions on 2026-03-19. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.11
3 findingsThis version was published by a different npm account than previous versions on 2026-03-16. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.10
2 findingsThis version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.9
2 findingsThis version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.8
3 findingsThis version was published by a different npm account than previous versions on 2026-03-12. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.6
3 findingsThis version was published by a different npm account than previous versions on 2026-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.5
3 findingsThis version was published by a different npm account than previous versions on 2026-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.4
3 findingsThis version was published by a different npm account than previous versions on 2026-03-11. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.3
3 findingsThis version was published by a different npm account than previous versions on 2026-03-10. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.31.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.30.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.