@crmy/server
CRMy server — Express + PostgreSQL + MCP endpoint
17
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
codycharris
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:public/assets/index-CdPJsOEj.js | AI (source-diff): Standard Vite/React production bundle; minification is expected for a bundled web UI asset. | ai | |
| source-diff | obfuscated-file:public/assets/index-BhdR5p_0.js | AI (source-diff): Standard Vite/React production bundle served as static UI asset; minification is expected for this package. | ai | |
| source-diff | obfuscated-file:public/assets/index-Bxk1RcTF.js | AI (source-diff): Standard Vite/React minified bundle; sample confirms React production build output, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:public/assets/index-D1Lhmm24.js | AI (source-diff): Standard Vite/React production bundle served as static UI assets; minification is expected and benign. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get usage is inside React internals within the bundled frontend; not obfuscation. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by addition of bundled frontend assets (React SPA build output). | ai | |
| source-diff | obfuscated-file:public/assets/index-CskfWp8E.js | AI (source-diff): Standard Vite/React production bundle; React license header and modulepreload patterns confirm legitimate minified frontend asset. | ai | |
| phantom-deps | phantom-dep:@crmy/web | AI (phantom-deps): Same-org web frontend served by Express; declared dep not directly imported is expected. | ai | |
| phantom-deps | phantom-dep:nodemailer | AI (phantom-deps): nodemailer used at runtime via dynamic config; stable false positive for this server package. | ai | |
| phantom-deps | phantom-dep:node-pg-migrate | AI (phantom-deps): Migration CLI tool invoked via scripts, not imported; stable false positive. | ai | |
| source-diff | obfuscated-file:public/assets/ContactDrawer-CFXKV2x4.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Contacts-yNFhQutT.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Context-BVQiQD9q.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/CrmWidgets-sMNLaPuG.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Dashboard-CvjByMY1.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/EmailDraftDrawer-Dyow1HEl.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/EmailDrawer-BnCT3LRh.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Emails-BP-9TS5i.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/en-US-ZtQonj2f.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Package bundles a React frontend; large number of Vite-generated asset files is expected for this package. | ai | |
| source-diff | obfuscated-file:public/assets/date-picker-DRo4EldO.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/AccountDrawer-Dj5RN41t.js | AI (source-diff): Standard Vite minified React bundle output; readable JSX logic visible in sample, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:public/assets/Accounts-VnMLn5HS.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Activities-DsY5nOGv.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/ActivityDrawer-pFFRRITK.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Agent-Cc67gFfS.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/AgentActivity-BxEevx9y.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/AssignmentDrawer--eGGH_x5.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/AuditLog-C_BrGOFB.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| source-diff | obfuscated-file:public/assets/Automations-CoMKyXFZ.js | AI (source-diff): Standard Vite minified React bundle output. | ai | |
| typosquat | typosquat.levenshtein:semver | AI (typosquat): @crmy/server is a scoped CRM server package; Levenshtein match to 'semver' is coincidental, not impersonation. | ai |