@cloudflare/realtimekit-ui
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/realtimekit-ui/p-00b74ca8.entry.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-246115d9.entry.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-1f880eb7.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-150cb217.entry.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-11aca374.entry.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-10bddcda.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-0f32251b.entry.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-0ea18e25.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-09aa740a.entry.js | AI (source-diff): Stencil.js bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-01ef7b4d.entry.js | AI (source-diff): Stencil/webpack bundled component output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-026e8157.entry.js | AI (source-diff): Minified Stencil build output, not obfuscation; bundled component chunk. | ai | |
| source-diff | obfuscated-file:dist/components/p-20612910.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-0031a3c0.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. Stable pattern for this UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-003a95fc.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-02f091dd.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-06f49c32.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-0928d88d.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-0b892bb4.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-0d674434.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-0e11efb7.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-0e5b6daf.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-10552fa5.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-1eb9b441.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-238e36c9.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-242afbdf.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-29097dbf.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-2af1d7f6.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-2e897160.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-2fac891e.entry.js | AI (source-diff): Stencil.js minified build output; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/p-1945dd0d.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-18dd7b43.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/components/p-1e7879b2.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-25c0a5dc.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/components/p-2add3860.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large file count is expected for Stencil.js component library builds with per-component chunking. | ai | |
| provenance | publisher-changed | AI (provenance): Cloudflare migrated publishing to GitHub Actions CI/CD with SLSA provenance; consistent with org-level automation. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): cf-npm-publish is Cloudflare's centralized npm publish account; legitimate consolidation. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Individual maintainers removed in favor of centralized cf-npm-publish; consistent with Cloudflare automation migration. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-16cbe34d.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-1135e0f2.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-111881d0.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/components/p-0b33743b.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-067797c4.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/components/p-06494ae4.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/components/p-1d945d79.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/components/p-1d2420a8.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| source-diff | obfuscated-file:dist/realtimekit-ui/p-1a53e8cd.entry.js | AI (source-diff): Standard Stencil.js minified build output for Cloudflare's official UI component library. | ai | |
| dependencies | unvetted-dep:hark | AI (dependencies): hark is a legitimate audio activity detection library; stable dependency for a UI/media package like this. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 2.0.1 | 5 / 0 | |
| 2.0.0 | 5 / 0 | |
| 1.2.0 | 5 / 0 | |
| 1.1.2 | 5 / 0 | |
| 1.1.1 | 5 / 0 | |
| 1.1.0 | 5 / 0 | |
| 1.0.8 | 5 / 0 | |
| 1.0.7 | 5 / 0 |
v2.0.1
17 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.1
11 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (dash_service_account) than the most recent previously approved version (third774) on 2026-03-10, but dash_service_account is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.0
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.