@duckcodeailabs/dql-cli
Public CLI for parsing, formatting, testing, and certifying DQL blocks
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BpPs6_rz.js | AI (source-diff): Bundled vite/notebook app entry, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-g0QVJ0wA.js | AI (source-diff): Bundled Vite/React app entry, standard minified build output. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-XSlscC_Y.js | AI (source-diff): Bundled Vite entry file for notebook UI, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BTKK8XQq.js | AI (source-diff): Vite-bundled notebook app entry, standard minified output. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BhNs4jWA.js | AI (source-diff): Bundled Vite app entry, standard minified output. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-QJKCrLXe.js | AI (source-diff): Bundled Vite output for notebook UI, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-nDZHVgfg.js | AI (source-diff): Vite-bundled notebook app entry, standard minified output. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-A4ATUOrs.js | AI (source-diff): Bundled notebook app entry, Vite build output not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-D99oHXXj.js | AI (source-diff): Vite-bundled notebook UI (react/codemirror chunks), minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Dgqvyn5s.js | AI (source-diff): Vite bundle of notebook UI assets (react/codemirror), not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DPcxWQuS.js | AI (source-diff): Vite/Rollup bundled notebook UI assets, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-CcpAv4lQ.js | AI (source-diff): Vite-bundled notebook frontend asset, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-rJXLSheJ.js | AI (source-diff): Vite-bundled notebook frontend asset, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BFTvljNh.js | AI (source-diff): Vite-bundled notebook UI asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BWqu4s9j.js | AI (source-diff): Vite/Rollup bundled frontend asset, not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/react-BRY8hXab.js | AI (source-diff): Minified React production bundle, standard build output. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-D-wXlE3-.js | AI (source-diff): Bundled notebook UI app output (React/CodeMirror), build artifact. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/codemirror-Co0dCEDr.js | AI (source-diff): Minified CodeMirror bundle, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-osG-H64_.js | AI (source-diff): Vite-bundled notebook UI asset, not obfuscation; matches known build artifact pattern. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Hq75M4K9.js | AI (source-diff): Bundled Vite/Rollup frontend asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-L-zyCapt.js | AI (source-diff): Bundled Vite/React/CodeMirror notebook UI asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BFUUTIWF.js | AI (source-diff): Bundled Vite/Rollup frontend asset (react/codemirror), not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-60sOoPrg.js | AI (source-diff): Bundled Vite/React app output for notebook UI, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DZ_5zsCw.js | AI (source-diff): Vite-bundled frontend asset, not obfuscation; long minified lines are standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DZ2X3-OY.js | AI (source-diff): Minified Vite/React/CodeMirror bundle for notebook UI, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Wl3Yxney.js | AI (source-diff): Vite-bundled notebook UI asset; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-D_tpetmE.js | AI (source-diff): Vite-bundled notebook frontend asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-t1D8YGzD.js | AI (source-diff): Vite-bundled React notebook UI, minified not obfuscated. | ai | |
| dependencies | unvetted-dep:isomorphic-git | AI (dependencies): Established git library, fits CLI git functionality. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-CIMLd3Cb.js | AI (source-diff): Standard Vite-bundled React/CodeMirror frontend asset; minification is expected for notebook UI dist files. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-CEMXuPm0.js | AI (source-diff): Standard Vite-bundled React/CodeMirror frontend asset; minification is expected for notebook UI dist files. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-C4oZK5xm.js | AI (source-diff): Standard Vite-bundled React/CodeMirror frontend asset; minification is expected for notebook UI dist files. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BbGJ8gZk.js | AI (source-diff): Standard Vite-bundled React/CodeMirror frontend asset; minification is expected for notebook UI dist files. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DISMWw19.js | AI (source-diff): Standard Vite-bundled React/CodeMirror frontend asset; minification is expected for notebook UI dist files. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-McpLeeN0.js | AI (source-diff): Standard Vite-bundled React/CodeMirror frontend asset; minification is expected for notebook UI dist files. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-mcp | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:isomorphic-git | AI (phantom-deps): Likely used via dynamic require or sub-module; stable for CLI package. | ai | |
| phantom-deps | phantom-dep:nodemailer | AI (phantom-deps): Likely used via dynamic require or sub-module; stable for CLI package. | ai | |
| phantom-deps | phantom-dep:node-cron | AI (phantom-deps): Likely used via dynamic require or sub-module; stable for CLI package. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Common config-parsing dep in CLI tools; stable false positive. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-governance | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-connectors | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-notebook | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-compiler | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-slack | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-agent | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-core | AI (phantom-deps): Same-org CLI sub-package; stable phantom-dep pattern for this monorepo. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DWPIGGBJ.js | AI (source-diff): Vite-bundled React/CodeMirror frontend asset; minified, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-B5jI3I8Q.js | AI (source-diff): Standard Vite/React minified bundle for notebook UI; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-mlfOQ2me.js | AI (source-diff): Standard Vite/React minified bundle output; not malicious obfuscation. Stable pattern for this package's notebook UI assets. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-B06pd_fZ.js | AI (source-diff): Vite-bundled React+CodeMirror notebook UI; minified frontend output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-dZVjj9xj.js | AI (source-diff): Standard Vite-bundled frontend asset for notebook UI; minification is expected, not malicious. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Cscl1A2H.js | AI (source-diff): Vite/React production bundle with CodeMirror; standard minified frontend output for this CLI's notebook feature. | ai | |
| source-diff | obfuscated-file:assets/dql-notebook/assets/react-CRB3T2We.js | AI (source-diff): Minified React production bundle; license header confirms Facebook/MIT origin. | ai | |
| source-diff | obfuscated-file:assets/dql-notebook/assets/codemirror-DJYUkPr1.js | AI (source-diff): Standard Vite/Rollup minified CodeMirror bundle; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:assets/dql-notebook/assets/index-DUTeFz5j.js | AI (source-diff): Standard Vite/Rollup minified app bundle with React imports; not obfuscated malware. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP is 127.0.0.1 (localhost runtime endpoint); not an exfiltration target. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same open-browser.js spawn; benign browser-launch pattern. | ai | |
| semgrep | semgrep:silent-process-exec | AI (semgrep): open-browser.js detaches a browser-open process; standard CLI pattern, not a reverse shell. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-CudxJ9DW.js | AI (source-diff): Standard Vite-bundled React app output; minification is expected for a notebook UI asset. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BJ7MV8Gv.js | AI (source-diff): Standard Vite/React minified bundle; sample shows normal React/CodeMirror imports with license headers, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BXbAhaFG.js | AI (source-diff): Standard Vite-bundled React frontend output with recognizable React JSX runtime and module preload polyfill. Expected artifact for a CLI that ships a notebook web UI. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DeyBtNqN.js | AI (source-diff): File is a standard Vite/Rollup minified bundle (React JSX runtime + CodeMirror), not malicious obfuscation. Content-hash filename is a Vite fingerprinting pattern. Consistent with dql-notebook UI dependency. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Cp34wXvX.js | AI (source-diff): File is standard Vite-bundled React/CodeMirror frontend output for the dql-notebook UI component. Minification is expected build artifact, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Cxj__xjY.js | AI (source-diff): This is standard Vite/Rollup-bundled output for the dql-notebook UI embedded in the CLI. Minified React/CodeMirror bundle; no obfuscation or malicious payload. Expected artifact for this package. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BJbWzCsK.js | AI (source-diff): Standard Vite-bundled React frontend for the dql-notebook UI; minified with content-addressed filename. No malicious patterns in sampled code. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BI2YwGNM.js | AI (source-diff): Standard Vite-bundled frontend app entry point with React and CodeMirror imports; minified as expected for a shipped notebook UI asset. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DhWFlKju.js | AI (source-diff): Standard Vite-bundled React app for the dql-notebook UI; sample shows recognizable React JSX runtime and modulepreload polyfill patterns. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-DIVTsVNu.js | AI (source-diff): File is a standard Vite-bundled React+CodeMirror frontend bundle for the embedded dql-notebook UI. Long lines are expected minification artifacts, not obfuscation. Pattern is stable for this package. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-aKKP3Syv.js | AI (source-diff): Standard Vite-bundled React frontend asset for the dql-notebook UI. Sample shows readable React/JSX runtime code with license headers. Not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/codemirror-BqWuFwtC.js | AI (source-diff): Minified CodeMirror editor library bundled by Vite as part of the notebook UI feature. Content is recognizable open-source code, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-C7OsQzmY.js | AI (source-diff): Standard Vite-bundled React app output for the notebook UI. Content-hash filename and React/Vite internals confirm this is a legitimate build artifact. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Dp-Vko5m.js | AI (source-diff): Vite-bundled frontend app importing React and CodeMirror. Sample shows standard React JSX runtime code; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Bs6rpYwW.js | AI (source-diff): Standard Vite-minified app bundle (React + CodeMirror imports); recognizable open-source library code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Be6ngE5t.js | AI (source-diff): Standard Vite-minified React app bundle for the dql-notebook UI. React JSX runtime license header is visible in the sample; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-_N_gerXe.js | AI (source-diff): Main Vite bundle importing React and CodeMirror; content is consistent with a legitimate notebook UI build artifact. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-N2OWUyOi.js | AI (source-diff): Standard Vite-bundled React app entry point for the notebook UI. Sample shows React JSX runtime and modulepreload polyfill — no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-8LrBWmPy.js | AI (source-diff): File is a standard Vite/Rollup minified bundle containing React and CodeMirror code — recognizable build artifact for the dql-notebook feature, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Rushqlh8.js | AI (source-diff): Vite/Rollup production bundle of React+CodeMirror notebook UI; standard minified frontend asset with React license headers, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-jwFfZgBm.js | AI (source-diff): Vite-bundled React notebook UI; contains React license headers and standard modulepreload polyfill. Legitimate build artifact. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/codemirror-DJYUkPr1.js | AI (source-diff): Vite-bundled CodeMirror editor library; standard minified build output for the dql-notebook frontend component. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BwgX4Mvs.js | AI (source-diff): Standard Vite-minified React app bundle with recognizable React/Facebook license headers. Minification artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-B_X7pyPz.js | AI (source-diff): Standard minified Vite/Rollup app bundle for dql-notebook UI. Sample shows React JSX runtime and modulepreload polyfill — no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-C7bfa1Fe.js | AI (source-diff): Standard Vite-bundled React app with react-jsx-runtime.production.min.js (Facebook copyright visible in sample). Expected build artifact for dql-notebook UI. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/codemirror-CCrEt63p.js | AI (source-diff): Standard Vite/Rollup production minification of the CodeMirror editor library. Sample confirms CodeMirror internals (grapheme-cluster tables, editor functions). Expected for a notebook UI. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-CtkxzMk1.js | AI (source-diff): Vite-bundled notebook app entry point importing React and CodeMirror. React JSX runtime license header visible in sample; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-Bf35WF3L.js | AI (source-diff): Standard Vite-bundled frontend app importing React and CodeMirror; minification is expected build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/codemirror-BeLuuzED.js | AI (source-diff): Standard minified CodeMirror library bundle produced by Vite build; not obfuscated malware. Stable for this package's notebook UI feature. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-BqahXnjO.js | AI (source-diff): Vite-bundled notebook UI entry point importing React and CodeMirror. No suspicious network calls or payload; expected build artifact. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase fully accounted for by three new frontend bundle files (CodeMirror + React + app entry) added with the dql-notebook dependency. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/codemirror-CHXCUnwU.js | AI (source-diff): Minified CodeMirror production bundle — standard Vite build output for the dql-notebook UI. Content is recognizable open-source code, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/react-CRB3T2We.js | AI (source-diff): Minified React production bundle with Facebook copyright header — standard Vite build output. Clearly legitimate open-source code. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-EE_LNEYl.js | AI (source-diff): Vite-bundled app entry point importing CodeMirror and React — standard frontend build artifact for the dql-notebook UI component. | ai | |
| provenance | missing-githead | AI (provenance): Publisher has a clean track record (46 approved, 0 rejected). Missing gitHead likely reflects a pipeline change, not a supply chain compromise. No other corroborating risk signals present. | ai | |
| source-diff | obfuscated-file:dist/assets/dql-notebook/assets/index-CTmiMNUc.js | AI (source-diff): File is a standard Vite/Rollup minified bundle for an embedded notebook web UI. Content shows recognizable React/CodeMirror imports with license headers — minification, not obfuscation. | ai | |
| phantom-deps | phantom-dep:@duckcodeailabs/dql-project | AI (phantom-deps): Same-org scoped dependency in a monorepo context; declared but not directly imported is a common and benign pattern here. | ai | |
| provenance | no-provenance | AI (provenance): Established @duckcodeailabs org package with 56 versions and legitimate repo; lack of Sigstore provenance is a process gap, not a security threat for this package. | ai |
Versions (showing 51 of 95)
| Version | Deps | Published |
|---|---|---|
| 1.6.31 | 15 / 7 | |
| 1.6.30 | 15 / 7 | |
| 1.6.29 | 15 / 7 | |
| 1.6.28 | 15 / 7 | |
| 1.6.27 | 15 / 7 | |
| 1.6.26 | 15 / 7 | |
| 1.6.25 | 15 / 7 | |
| 1.6.24 | 15 / 7 | |
| 1.6.23 | 15 / 7 | |
| 1.6.22 | 15 / 7 | |
| 1.6.21 | 15 / 7 | |
| 1.6.20 | 15 / 7 | |
| 1.6.19 | 15 / 7 | |
| 1.6.18 | 15 / 7 | |
| 1.6.17 | 15 / 7 | |
| 1.6.16 | 15 / 7 | |
| 1.6.15 | 15 / 7 | |
| 1.6.14 | 15 / 7 | |
| 1.6.13 | 15 / 7 | |
| 1.6.12 | 15 / 7 | |
| 1.6.11 | 13 / 7 | |
| 1.6.10 | 13 / 7 | |
| 1.6.9 | 13 / 7 | |
| 1.6.8 | 13 / 7 | |
| 1.6.7 | 13 / 7 | |
| 1.6.6 | 13 / 7 | |
| 1.6.5 | 13 / 7 | |
| 1.6.4 | 13 / 7 | |
| 1.6.3 | 13 / 7 | |
| 1.6.2 | 13 / 7 | |
| 1.6.1 | 13 / 7 | |
| 1.6.0 | 13 / 7 | |
| 1.5.3 | 13 / 7 | |
| 1.5.2 | 13 / 7 | |
| 1.5.1 | 13 / 7 | |
| 1.5.0 | 13 / 7 | |
| 1.4.4 | 13 / 0 | |
| 1.4.3 | 13 / 0 | |
| 1.4.1 | 13 / 6 | |
| 1.4.0 | 13 / 6 | |
| 1.3.6 | 11 / 6 | |
| 1.3.5 | 11 / 6 | |
| 1.3.4 | 11 / 6 | |
| 1.3.1 | 11 / 6 | |
| 1.3.0 | 11 / 6 | |
| 1.2.2 | 11 / 6 | |
| 1.2.0 | 11 / 6 | |
| 1.0.4 | 7 / 4 | |
| 1.0.3 | 6 / 4 | |
| 1.0.2 | 6 / 4 | |
| 1.0.1 | 6 / 4 |
v1.6.31
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.30
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.29
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.28
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.27
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.26
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.25
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.24
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: duckcode.
v1.6.23
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.22
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.21
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.