@contentauth/c2pa-web
The SDK for interacting with [C2PA metadata](https://c2pa.org/) on the web.
5
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
emenschandyp-adobecolmurph-adobeale-adobecaiopensrc
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/c2pa-DlCQhbLd.js | AI (source-diff): Vite/Rollup bundle of wasm-bindgen glue code; minified output is expected for this WASM web package. | ai | |
| source-diff | net-exec-file:dist/c2pa-DlCQhbLd.js | AI (source-diff): Network calls are part of the WASM loading pattern; no dropper behavior — standard wasm-bindgen + channel messaging. | ai | |
| source-diff | obfuscated-file:dist/c2pa-DKxSS-my.js | AI (source-diff): Minified wasm-bindgen glue bundle; standard build artifact for this WASM-based package. | ai | |
| source-diff | net-exec-file:dist/c2pa-DKxSS-my.js | AI (source-diff): Network+exec pattern is wasm-bindgen worker messaging, not dropper behavior; consistent with package purpose. | ai | |
| source-diff | obfuscated-file:dist/c2pa-DI2x_NCv.js | AI (source-diff): Vite-bundled wasm-bindgen output; minification is expected for this WASM web library. | ai | |
| source-diff | net-exec-file:dist/c2pa-DI2x_NCv.js | AI (source-diff): Network calls are part of WASM module loading; no dropper behavior evident in wasm-bindgen glue code. | ai | |
| dependencies | unvetted-dep:@contentauth/c2pa-types | AI (dependencies): Same org scope (@contentauth) as the publishing package; low risk. | ai | |
| phantom-deps | phantom-dep:@contentauth/c2pa-wasm | AI (phantom-deps): Same-org WASM package; exported via package.json exports map, not a direct JS import — stable false positive. | ai |