← Home

@dxos/shell

npm Repository Homepage

DXOS’s OS experiences

3
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

richburdonmarik_dwittjosiahdxos-botmykola-vrmchk

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:dist/bundle/shell.js AI (source-diff): Long base64 string is the UMALQURA_DATA Islamic calendar table, a known benign constant in @internationalized/date. ai
provenance publisher-changed AI (provenance): dxos-bot → GitHub Actions is a CI pipeline migration; SLSA attestation confirms legitimate automated publishing. ai
phantom-deps phantom-dep:scheduler AI (phantom-deps): scheduler is a React internal peer dep; referenced in bundler config, not directly imported. ai
phantom-deps phantom-dep:use-sync-external-store AI (phantom-deps): use-sync-external-store is a React compatibility shim; bundler config reference is expected. ai
phantom-deps phantom-dep:emoji-mart AI (phantom-deps): Config-file reference; stable false positive for this package. ai
phantom-deps phantom-dep:@emoji-mart/data AI (phantom-deps): Config-file reference; stable false positive for this package. ai
provenance no-provenance AI (provenance): DXOS monorepo bot-published packages consistently lack provenance; stable pattern across 1402 versions. ai
phantom-deps phantom-dep:@radix-ui/react-accordion AI (phantom-deps): Config-file reference; stable false positive for this package. ai
phantom-deps phantom-dep:@radix-ui/react-radio-group AI (phantom-deps): Config-file reference; stable false positive for this package. ai
phantom-deps phantom-dep:@emoji-mart/react AI (phantom-deps): Config-file reference; stable false positive for this package. ai
phantom-deps phantom-dep:@dxos/debug AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic is a stable false positive for this monorepo package. ai
phantom-deps phantom-dep:@dxos/client-services AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic is a stable false positive for this monorepo package. ai
phantom-deps phantom-dep:url-join AI (phantom-deps): Config-file reference; stable false positive for this package. ai

Versions (showing 3 of 3)

Version Deps Published
0.10.0 21 / 18
0.9.0 20 / 18
0.8.3 27 / 16

v0.10.0

2 findings
HIGH Long encoded string in modified file: dist/bundle/shell.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.