@decaf-ts/for-nest — Greenflagged

NestJS decaf integration

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

tvenceslauvnogueira91

Keywords

nestjsroutinghttprestservertypescriptts

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/for-nest.js	AI (source-diff): dist/ is standard bundled minified output for this package; no malicious patterns in sample.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/factory/exceptions/ValidationExceptionFilter.js	AI (source-diff): ESM counterpart; same inline sourcemap pattern, readable code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/factory/openapi/SwaggerCustomUI.js	AI (source-diff): ESM counterpart; same inline sourcemap pattern, readable code.	ai	2026/05/13
source-diff	obfuscated-file:lib/factory/exceptions/AuthorizationExceptionFilter.cjs	AI (source-diff): Inline sourcemap causes long lines; code is readable NestJS exception filter.	ai	2026/05/13
source-diff	obfuscated-file:lib/factory/exceptions/GlobalExceptionFilter.cjs	AI (source-diff): Inline sourcemap causes long lines; code is readable NestJS exception filter.	ai	2026/05/13
source-diff	obfuscated-file:lib/factory/NestBootstraper.cjs	AI (source-diff): Inline sourcemap causes long lines; code is readable NestJS bootstrapper.	ai	2026/05/13
source-diff	obfuscated-file:lib/factory/openapi/SwaggerBuilder.cjs	AI (source-diff): Inline sourcemap causes long lines; code is readable Swagger builder.	ai	2026/05/13
source-diff	obfuscated-file:lib/factory/openapi/SwaggerCustomUI.cjs	AI (source-diff): Inline sourcemap causes long lines; code is readable Swagger UI customization.	ai	2026/05/13
source-diff	obfuscated-file:lib/factory/exceptions/ValidationExceptionFilter.cjs	AI (source-diff): Inline sourcemap causes long lines; code is readable NestJS validation filter.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/factory/exceptions/AuthorizationExceptionFilter.js	AI (source-diff): ESM counterpart; same inline sourcemap pattern, readable code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/factory/exceptions/GlobalExceptionFilter.js	AI (source-diff): ESM counterpart; same inline sourcemap pattern, readable code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/factory/openapi/SwaggerBuilder.js	AI (source-diff): ESM counterpart; same inline sourcemap pattern, readable code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/factory/NestBootstraper.js	AI (source-diff): ESM counterpart; same inline sourcemap pattern, readable code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/model-module.js	AI (source-diff): Standard ESM TypeScript compiler output with __decorate/__metadata boilerplate.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/decorators/ApiProperty.js	AI (source-diff): Standard ESM TypeScript compiler output; readable NestJS/Swagger decorator code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/decoration.js	AI (source-diff): Standard ESM TypeScript compiler output; readable NestJS integration code.	ai	2026/05/13
source-diff	obfuscated-file:lib/esm/decorators/helpers.js	AI (source-diff): Standard ESM TypeScript compiler output; readable decorator helper code.	ai	2026/05/13
source-diff	obfuscated-file:lib/decorators/ApiProperty.cjs	AI (source-diff): Standard TypeScript compiler output; long lines from bundled decorator logic, not obfuscation.	ai	2026/05/13
source-diff	obfuscated-file:lib/decoration.cjs	AI (source-diff): Standard TypeScript compiler output; readable NestJS integration code.	ai	2026/05/13
source-diff	obfuscated-file:lib/decorators/helpers.cjs	AI (source-diff): Standard TypeScript compiler output; readable decorator helper code.	ai	2026/05/13
source-diff	obfuscated-file:lib/model-module.cjs	AI (source-diff): Standard TypeScript compiler output with __decorate/__metadata boilerplate.	ai	2026/05/13
dependencies	unvetted-dep:@decaf-ts/logging	AI (dependencies): Same org (@decaf-ts) dependency; consistent with the rest of the package's dependency graph.	ai	2026/05/07
phantom-deps	phantom-dep:@decaf-ts/transactional-decorators	AI (phantom-deps): Same org scope; declared as dep, likely re-exported transitively rather than directly imported.	ai	2026/05/02
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require in CLI module loading user-specified NestJS app modules by path — expected pattern for this tooling.	ai	2026/05/02

Versions (showing 45 of 45)

Version	Deps	Published
0.3.14	9 / 17	2026-04-29
0.3.13	8 / 17	2026-04-24
0.3.12	8 / 17	2026-04-09
0.3.11	8 / 17	2026-04-09
0.3.10	8 / 17	2026-04-08
0.3.9	8 / 17	2026-04-08
0.3.8	8 / 17	2026-04-07
0.3.7	8 / 17	2026-03-31
0.3.6	8 / 17	2026-03-27
0.3.5	8 / 17	2026-03-26
0.3.4	8 / 17	2026-03-23
0.3.3	8 / 17	2026-03-23
0.3.2	8 / 17	2026-03-23
0.3.0	8 / 16	2026-03-20
0.2.42	8 / 15	2026-03-11
0.2.41	8 / 15	2026-03-06
0.2.37	8 / 15	2026-03-05
0.2.35	8 / 15	2026-03-04
0.2.29	8 / 13	2026-02-19
0.2.28	8 / 13	2026-02-19
0.2.27	8 / 13	2026-02-13
0.2.26	8 / 13	2026-02-06
0.2.25	8 / 13	2026-02-06
0.2.17	8 / 13	2026-01-27
0.2.16	8 / 13	2026-01-26
0.1.22	8 / 12	2026-01-02
0.1.21	8 / 12	2025-12-31
0.1.20	8 / 12	2025-12-25
0.1.12	8 / 11	2025-12-22
0.1.8	9 / 10	2025-12-11
0.1.7	9 / 10	2025-12-10
0.1.6	9 / 10	2025-12-09
0.1.5	9 / 7	2025-11-27
0.1.3	9 / 7	2025-11-26
0.1.2	9 / 7	2025-11-26
0.1.1	9 / 7	2025-11-25
0.1.0	9 / 7	2025-11-20
0.0.9	9 / 7	2025-11-05
0.0.8	10 / 7	2025-11-04
0.0.7	10 / 7	2025-10-31
0.0.6	10 / 7	2025-10-28
0.0.5	0 / 36	2025-10-24
0.0.4	0 / 36	2025-10-23
0.0.3	0 / 36	2025-10-23
0.0.2	0 / 35	2025-10-22

v0.3.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.11

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tvenceslau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.42

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.41

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.37

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.35

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.29

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.20

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tvenceslau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.5

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tvenceslau.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.7

2 findings

HIGH New obfuscated file: dist/for-nest.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.6

2 findings

HIGH New obfuscated file: dist/for-nest.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.5

21 findings

HIGH New obfuscated file: lib/decorators/ApiProperty.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/factory/exceptions/AuthorizationExceptionFilter.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/decoration.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/factory/exceptions/GlobalExceptionFilter.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/decorators/helpers.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/model-module.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/factory/NestBootstraper.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/factory/openapi/SwaggerBuilder.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/factory/openapi/SwaggerCustomUI.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/factory/exceptions/ValidationExceptionFilter.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decorators/ApiProperty.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/factory/exceptions/AuthorizationExceptionFilter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decoration.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/factory/exceptions/GlobalExceptionFilter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decorators/helpers.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/model-module.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/factory/NestBootstraper.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/factory/openapi/SwaggerBuilder.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/factory/openapi/SwaggerCustomUI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/factory/exceptions/ValidationExceptionFilter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.4

9 findings

HIGH New obfuscated file: lib/decorators/ApiProperty.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/decoration.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/decorators/helpers.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/model-module.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decorators/ApiProperty.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decoration.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decorators/helpers.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/model-module.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.3

9 findings

HIGH New obfuscated file: lib/decorators/ApiProperty.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/decoration.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/decorators/helpers.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/model-module.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decorators/ApiProperty.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decoration.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/decorators/helpers.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: lib/esm/model-module.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.