@crystaldesign/web-planner-logic
11
Versions
COMMERCIAL
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
crystaldesign
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:build/esm/index-3b3988eb.js | AI (source-diff): Standard Babel/Rollup minified bundle output; consistent pattern across all versions of this package. | ai | |
| source-diff | net-exec-file:build/cjs/index-911f48e7.js | AI (source-diff): Network calls (axios, socket.io) are declared deps; no dynamic code execution beyond normal transpiler patterns. | ai | |
| source-diff | net-exec-file:build/esm/index-3b3988eb.js | AI (source-diff): Network calls (axios, socket.io) are declared deps; no dynamic code execution beyond normal transpiler patterns. | ai | |
| source-diff | obfuscated-file:build/cjs/index-911f48e7.js | AI (source-diff): Standard Babel/Rollup minified bundle output; consistent pattern across all versions of this package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Intentional for this internal commercial package; consistent across all versions. | ai | |
| dependencies | unvetted-dep:parsejson | AI (dependencies): Stable dependency in a long-running commercial package; no malicious indicators. | ai | |
| source-diff | obfuscated-file:build/cjs/index-d87be1c9.js | AI (source-diff): Standard Babel-transpiled minified bundle; consistent with this package's build pattern across versions. | ai | |
| source-diff | net-exec-file:build/cjs/index-d87be1c9.js | AI (source-diff): Network calls (axios, socket.io) and dynamic code are part of the planner logic; no dropper pattern visible in sample. | ai | |
| source-diff | net-exec-file:build/esm/index-1aac5961.js | AI (source-diff): Network calls (axios, socket.io) and dynamic code are part of the planner logic; no dropper pattern visible in sample. | ai | |
| source-diff | obfuscated-file:build/esm/index-1aac5961.js | AI (source-diff): Standard Babel-transpiled minified bundle; consistent with this package's build pattern across versions. | ai | |
| source-diff | obfuscated-file:build/cjs/index-5c59e38f.js | AI (source-diff): CJS minified build output; same pattern as ESM counterpart, consistent with established build pipeline. | ai | |
| source-diff | net-exec-file:build/esm/index-4070d7a2.js | AI (source-diff): Network calls (axios, socket.io) are core library functionality, not dropper behavior; stable for this package. | ai | |
| source-diff | obfuscated-file:build/esm/index-4070d7a2.js | AI (source-diff): Minified build output with Babel helpers; consistent with this package's established build pipeline. | ai | |
| source-diff | net-exec-file:build/cjs/index-5c59e38f.js | AI (source-diff): Same axios/socket.io usage as ESM build; core library functionality, not malware. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established private enterprise package with 3900+ versions; sparse metadata is expected for internal libraries. | ai | |
| phantom-deps | phantom-dep:jsdom | AI (phantom-deps): jsdom is declared as both a dependency and peerDependency; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:parsejson | AI (phantom-deps): Stable false positive for this package; parsejson is a declared runtime dependency. | ai |