@composio/core
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/customTool.types-kFhNYuzh.d.mts | AI (source-diff): Generated .d.mts type declarations; readable Zod schemas, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/composio-6C8kHtqc.d.mts | AI (source-diff): Generated .d.mts declaration file with long import lines; build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/BaseProvider-lCxnjFKQ.d.mts | AI (source-diff): Large generated .d.mts type-declaration bundle from tsdown; readable, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/composio-DHIKRdeG.d.mts | AI (source-diff): Generated bundled type declarations; readable TS, long import lines only. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-DXin7Cfc.d.mts | AI (source-diff): Generated type declarations; readable schema defs. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-CKH2R2ia.d.mts | AI (source-diff): Generated type declarations; readable schema defs. | ai | |
| source-diff | obfuscated-file:dist/composio-vMwhASRc.d.mts | AI (source-diff): Generated bundled type declarations; readable TS, long import lines only. | ai | |
| source-diff | obfuscated-file:dist/composio-DRl6WCI9.d.mts | AI (source-diff): Generated .d.mts type-declaration file; tsdown build output. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-CMOMgxoM.d.mts | AI (source-diff): Generated .d.mts type-declaration file; tsdown build output. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-BzEWHa0w.d.cts | AI (source-diff): Generated .d.cts type-declaration file; tsdown build output. | ai | |
| source-diff | obfuscated-file:dist/composio-CSMCZZgj.d.cts | AI (source-diff): Generated .d.cts type-declaration file with long type lines; build output, not obfuscation. | ai | |
| dependencies | unvetted-dep:@composio/client | AI (dependencies): First-party sibling package from same publisher/org, stable across versions. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reads only env vars matching a prefix; standard config pattern for this SDK. | ai | |
| source-diff | obfuscated-file:dist/composio-BHSQwOUz.d.mts | AI (source-diff): Bundled .d.mts declaration file with re-exports; standard tsdown output. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-9yFqPjdw.d.mts | AI (source-diff): Bundled .d.mts declaration file; long Zod schema lines are expected. | ai | |
| source-diff | obfuscated-file:dist/BaseProvider-Brb3o86-.d.mts | AI (source-diff): TypeScript declaration file with long Zod type lines from tsdown bundler; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/composio-DfPD7BAi.d.mts | AI (source-diff): Bundled .d.mts declaration file with re-exports; standard tsdown output. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-D-6YqFdW.d.mts | AI (source-diff): Bundled .d.mts declaration file; long Zod schema lines are expected. | ai | |
| source-diff | obfuscated-file:dist/composio-BJW2NaoA.d.mts | AI (source-diff): TypeScript declaration file with long Zod type lines; not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/composio-DTntXzL-.d.cts | AI (source-diff): TypeScript declaration file with long Zod type lines; not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-Bd8ylotX.d.cts | AI (source-diff): TypeScript declaration file with long Zod type lines; not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/tool.types-CwbAy9l_.d.cts | AI (source-diff): TypeScript declaration file with long Zod type lines; not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-B3HG185y.d.mts | AI (source-diff): TypeScript declaration file with long Zod type lines; not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/tool.types-CB_4JKhV.d.mts | AI (source-diff): TypeScript declaration file with long Zod type lines; not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-DpIdOJjL.d.mts | AI (source-diff): Bundled .d.mts type declarations; long Zod schema lines, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/composio-CHnEggnv.d.mts | AI (source-diff): Bundled .d.mts type declarations; long lines from re-exports, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/BaseProvider-BBnsv9kS.d.mts | AI (source-diff): Bundled .d.mts type declarations with long Zod schema lines; not obfuscation. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Scoped org package with established history; empty description is cosmetic. | ai | |
| source-diff | obfuscated-file:dist/composio-pcA13w87.d.cts | AI (source-diff): TypeScript declaration file with long import/type lines, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/BaseProvider-CVbQxTNa.d.cts | AI (source-diff): TypeScript declaration file with long Zod type lines, not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/BaseProvider-BvHvJLXc.d.mts | AI (source-diff): TypeScript declaration file with long Zod type lines, not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-DLIORcYN.d.mts | AI (source-diff): TypeScript declaration file with long Zod schema lines, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-QtkAZQma.d.cts | AI (source-diff): TypeScript declaration file with long Zod schema lines, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/composio-BlASKqjQ.d.mts | AI (source-diff): TypeScript declaration file with long import/type lines, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-2DhEI1vs.d.cts | AI (source-diff): Bundled TypeScript declaration file (.d.cts) with long type-export lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/tool.types-CNYy-lBq.d.mts | AI (source-diff): Bundled TypeScript declaration file (.d.mts) with long type-export lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/customTool.types-BL_z-C_B.d.mts | AI (source-diff): Bundled TypeScript declaration file (.d.mts) with long type-export lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/composio-CwcLLO7C.d.mts | AI (source-diff): Bundled TypeScript declaration file (.d.mts) with long type-export lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/tool.types-BlXcjUs1.d.cts | AI (source-diff): Bundled TypeScript declaration file (.d.cts) with long type-export lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/composio-B75SFMkx.d.cts | AI (source-diff): Bundled TypeScript declaration file (.d.cts) with long type-export lines; not obfuscated code. | ai | |
| phantom-deps | phantom-dep:@types/json-schema | AI (phantom-deps): @types/json-schema is a type-only dep used at compile time; not directly imported at runtime by convention. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @composio/core is the Composio platform SDK, not a typosquat of cors; scoped namespace makes this a stable false positive. | ai |
Versions (showing 51 of 61)
| Version | Deps | Published |
|---|---|---|
| 0.14.0 | 8 / 8 | |
| 0.13.1 | 8 / 8 | |
| 0.13.0 | 8 / 8 | |
| 0.12.0 | 8 / 8 | |
| 0.11.0 | 8 / 8 | |
| 0.10.0 | 8 / 8 | |
| 0.9.1 | 8 / 8 | |
| 0.9.0 | 8 / 8 | |
| 0.8.1 | 8 / 8 | |
| 0.8.0 | 8 / 8 | |
| 0.7.0 | 8 / 8 | |
| 0.6.11 | 8 / 8 | |
| 0.6.10 | 8 / 8 | |
| 0.6.9 | 8 / 8 | |
| 0.6.8 | 8 / 8 | |
| 0.6.7 | 8 / 8 | |
| 0.6.6 | 8 / 8 | |
| 0.6.5 | 8 / 8 | |
| 0.6.4 | 8 / 8 | |
| 0.6.3 | 8 / 8 | |
| 0.6.2 | 8 / 8 | |
| 0.6.1 | 8 / 8 | |
| 0.6.0 | 8 / 8 | |
| 0.5.5 | 8 / 8 | |
| 0.5.4 | 8 / 8 | |
| 0.5.3 | 8 / 8 | |
| 0.5.2 | 8 / 8 | |
| 0.5.1 | 8 / 8 | |
| 0.5.0 | 8 / 8 | |
| 0.4.0 | 9 / 9 | |
| 0.3.4 | 9 / 8 | |
| 0.3.3 | 9 / 8 | |
| 0.3.2 | 9 / 8 | |
| 0.3.1 | 9 / 8 | |
| 0.3.0 | 9 / 8 | |
| 0.2.6 | 9 / 7 | |
| 0.2.5 | 9 / 7 | |
| 0.2.4 | 9 / 7 | |
| 0.2.3 | 9 / 7 | |
| 0.2.2 | 9 / 7 | |
| 0.1.32 | 10 / 6 | |
| 0.1.31 | 10 / 6 | |
| 0.1.30 | 10 / 6 | |
| 0.1.29 | 10 / 6 | |
| 0.1.28 | 9 / 6 | |
| 0.1.27 | 9 / 6 | |
| 0.1.26 | 9 / 6 | |
| 0.1.25 | 9 / 6 | |
| 0.1.24 | 9 / 6 | |
| 0.1.23 | 9 / 6 | |
| 0.1.22 | 9 / 6 |
v0.14.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.1
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.