@eclipse-docks/core
Eclipse Docks platform core: registries, services, parts, widgets, and API
43
Versions
EPL-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
erdalkaraca
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/webawesome-CJyhVNu_.js | AI (source-diff): Barrel re-export of @awesome.me/webawesome components; long lines from bundled CSS/component defs, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/api-CFU8KuHz.js | AI (source-diff): Vite-bundled ESM chunk; imports lit/marked/internal modules — no actual dropper pattern. | ai | |
| source-diff | net-exec-file:dist/api-GQXzRSc-.js | AI (source-diff): Bundled Vite output chunk; network+exec pattern is from legitimate UI framework code, not malware. | ai | |
| source-diff | net-exec-file:dist/api-7hn-j6Rf.js | AI (source-diff): Standard Vite-bundled ESM chunk; network calls are workspace/FS service imports, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/api-DISr4dl4.js | AI (source-diff): Vite bundle with readable ESM imports; no malicious network/exec pattern visible in sample. | ai | |
| source-diff | net-exec-file:dist/api-CRqV4LEn.js | AI (source-diff): Vite-bundled ESM output; sample shows standard lit/marked/JSZip imports, no actual dropper pattern. | ai | |
| source-diff | net-exec-file:dist/api-CuHseuRW.js | AI (source-diff): Vite-bundled UI framework dist; network calls are workspace/API service code, not dropper behavior. SLSA provenance confirms CI build. | ai | |
| source-diff | net-exec-file:dist/api-CRZ-pC4q.js | AI (source-diff): Vite-bundled app chunk with Lit/marked imports; not malware. Pattern will recur with each build artifact rename. | ai | |
| source-diff | net-exec-file:dist/api-BgmPPeuo.js | AI (source-diff): Vite-bundled output; sample shows standard ES module imports from known deps, no malicious network/exec pattern. | ai | |
| source-diff | net-exec-file:dist/api-Cg6BlZPe.js | AI (source-diff): Vite-bundled ESM output with standard framework imports; no actual dropper/loader behavior in sampled code. | ai | |
| source-diff | obfuscated-file:dist/webawesome-CsYKhg4S.js | AI (source-diff): Barrel re-export of @awesome.me/webawesome components; long lines are from minified upstream bundle, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/api-C8Vh88fr.js | AI (source-diff): Standard Vite-bundled ESM output; network calls and dynamic execution are part of the documented platform API, not dropper behavior. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publisher is consistent with SLSA-attested CI/CD pipeline; not a compromise indicator. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped Eclipse platform package; name similarity to 'cors' is coincidental, not a squatting attempt. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used in a JS runtime worker to execute user-supplied scripts; intentional design, not malicious code execution. | ai | |
| phantom-deps | phantom-dep:@fortawesome/free-solid-svg-icons | AI (phantom-deps): Same as above — config-level reference, not a direct import. | ai | |
| phantom-deps | phantom-dep:@fortawesome/fontawesome-svg-core | AI (phantom-deps): Same as above — config-level reference, not a direct import. | ai | |
| phantom-deps | phantom-dep:@fortawesome/fontawesome-free | AI (phantom-deps): FontAwesome deps referenced in config/externals, not directly imported in source; stable false positive for this package. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 0.7.110 | 8 / 7 | |
| 0.7.109 | 8 / 7 | |
| 0.7.108 | 8 / 7 | |
| 0.7.107 | 8 / 7 | |
| 0.7.106 | 8 / 7 | |
| 0.7.105 | 8 / 7 | |
| 0.7.104 | 8 / 7 | |
| 0.7.103 | 8 / 7 | |
| 0.7.102 | 8 / 7 | |
| 0.7.101 | 8 / 7 | |
| 0.7.100 | 8 / 7 | |
| 0.7.99 | 8 / 7 | |
| 0.7.98 | 8 / 7 | |
| 0.7.97 | 8 / 7 | |
| 0.7.96 | 8 / 7 | |
| 0.7.95 | 8 / 7 | |
| 0.7.94 | 8 / 7 | |
| 0.7.93 | 8 / 7 | |
| 0.7.92 | 8 / 7 | |
| 0.7.91 | 8 / 7 | |
| 0.7.90 | 8 / 7 | |
| 0.7.89 | 8 / 7 | |
| 0.7.88 | 8 / 7 | |
| 0.7.87 | 8 / 7 | |
| 0.7.86 | 8 / 7 | |
| 0.7.85 | 8 / 7 | |
| 0.7.84 | 8 / 7 | |
| 0.7.83 | 8 / 7 | |
| 0.7.82 | 8 / 7 | |
| 0.7.81 | 8 / 7 | |
| 0.7.80 | 8 / 7 | |
| 0.7.79 | 8 / 7 | |
| 0.7.78 | 8 / 7 | |
| 0.7.77 | 8 / 7 | |
| 0.7.76 | 8 / 6 | |
| 0.7.75 | 8 / 6 | |
| 0.7.74 | 8 / 6 | |
| 0.7.73 | 8 / 6 | |
| 0.7.72 | 8 / 6 | |
| 0.7.71 | 8 / 6 | |
| 0.7.70 | 8 / 6 | |
| 0.7.69 | 8 / 6 | |
| 0.7.68 | 8 / 6 |