@estjs/server — Greenflagged

Server-side rendering for Essor framework

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

estjs

essorssrssgserverhydration

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/server.cjs	AI (source-diff): Standard tsup minified build output; readable SSR logic, no malicious patterns.	ai	2026/05/31
source-diff	obfuscated-file:dist/server.js	AI (source-diff): Standard tsup minified build output; readable SSR logic, no malicious patterns.	ai	2026/05/31
source-diff	source-size-tripled	AI (source-diff): Size increase explained by bundling new @estjs/signals sibling dep into the dist output.	ai	2026/05/31
typosquat	typosquat.levenshtein:semver	AI (typosquat): Scoped Essor framework SSR package; name similarity to semver is coincidental, not impersonation.	ai	2026/05/04

3 findings

HIGH New obfuscated file: dist/server.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'semver' typosquat

Package name '@estjs/server' is 1 edit(s) away from popular package 'semver'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.