@everymatrix/general-player-forgot-password-form-nd
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-BNHZGebC.js | AI (source-diff): Network calls and dynamic code are standard Svelte component fetch/DOM patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-BNHZGebC.js | AI (source-diff): Minified Vite/Rollup bundle output; readable Svelte runtime code, not obfuscation. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-DQs7ZL5h.js | AI (source-diff): Minified Svelte component bundle; same pattern as other files in this package. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-Dc-aW1Ro.js | AI (source-diff): Minified Svelte component bundle; imports from sibling file, not obfuscation. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-vHboKcRo.js | AI (source-diff): Same Svelte runtime network/DOM pattern; not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-vHboKcRo.js | AI (source-diff): Same minified Svelte bundle pattern; not obfuscation. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-9bJr1hqg.cjs | AI (source-diff): Network calls and dynamic code are Svelte framework patterns (fetch + Promise); no dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-9bJr1hqg.cjs | AI (source-diff): Standard Svelte/Vite minified build output; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-BmWaejpp.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-D67_z7C4.js | AI (source-diff): Network calls and dynamic code are Svelte framework patterns; no dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-D67_z7C4.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-6VkSg6vF.js | AI (source-diff): Network calls and dynamic code are Svelte framework patterns; no dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-6VkSg6vF.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CfaQEOJa.cjs | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-Bnh9kZlJ.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-Bm5GwVTm.js | AI (source-diff): Network calls and dynamic execution are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-Bm5GwVTm.js | AI (source-diff): Standard Vite/Svelte minified build artifact; consistent with this package's established build pipeline. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CsE9ESWu.cjs | AI (source-diff): Network calls and dynamic execution are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CsE9ESWu.cjs | AI (source-diff): Standard Vite/Svelte minified build artifact; consistent with this package's established build pipeline. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CqSiRmcO.js | AI (source-diff): Network calls and dynamic execution are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CqSiRmcO.js | AI (source-diff): Standard Vite/Svelte minified build artifact; consistent with this package's established build pipeline. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CxWaMZ-H.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-DUo-Gv6e.cjs | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-DKhLI8CP.cjs | AI (source-diff): Standard Svelte/Vite minified build output; not obfuscation. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-DKhLI8CP.cjs | AI (source-diff): Network calls and dynamic code are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-C94Fg4vY.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-BHCK5b0Y.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-DSdVVjUO.js | AI (source-diff): Network calls and dynamic code are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-DSdVVjUO.js | AI (source-diff): Standard Svelte/Vite minified build output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CxWaMZ-H.js | AI (source-diff): Network calls and dynamic code are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-q0Rkr7_k.cjs | AI (source-diff): Standard Svelte/Vite minified bundle output; not obfuscation. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CO22htQd.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CcH-78-j.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-dxvMBzO1.js | AI (source-diff): DOM/fetch calls in Svelte runtime bundle; not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-dxvMBzO1.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-BjZsZd5D.js | AI (source-diff): DOM/fetch calls in Svelte runtime bundle; not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-BjZsZd5D.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-BbOiU-Q7.cjs | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-q0Rkr7_k.cjs | AI (source-diff): DOM/fetch calls in Svelte runtime bundle; not dropper behavior. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CWg7OQqq.js | AI (source-diff): Same Svelte bundle; false positive. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CzyXcPLy.cjs | AI (source-diff): Standard Vite/Rollup minified bundle for a Svelte component; not malicious obfuscation. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CzyXcPLy.cjs | AI (source-diff): Network calls and dynamic code are Svelte runtime patterns (fetch for i18n/API, new Function in vaadin dev-mode detector); no dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CGPuWytt.js | AI (source-diff): Same Svelte bundle, minified output; false positive for this package. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CGPuWytt.js | AI (source-diff): Same Svelte bundle; net+exec pattern is Svelte runtime + vaadin dev detector, not malware. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CWg7OQqq.js | AI (source-diff): Minified Svelte bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CSDhpguc.cjs | AI (source-diff): Minified Svelte/CJS bundle; false positive. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CZ4sauHW.js | AI (source-diff): Minified Svelte bundle; false positive. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-DEGxwZar.js | AI (source-diff): Minified Svelte bundle; false positive. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-BAnLT2lx.cjs | AI (source-diff): Standard Svelte/Vite minified bundle output; not obfuscation. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-BOGivfUg.cjs | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-DViiEZCu.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CgGL8acE.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-JBlHWA1X.js | AI (source-diff): Svelte runtime patterns; not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-JBlHWA1X.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CUu6viTK.js | AI (source-diff): Svelte runtime patterns; not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CUu6viTK.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-BAnLT2lx.cjs | AI (source-diff): Network calls and dynamic code are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-zHNWL0BM.cjs | AI (source-diff): Network+exec pattern is Promise/async transpilation in Svelte runtime, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-NyHeBvzg.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-D5AmVWDf.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-ByDXjWJp.cjs | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-DQXQ3vdz.js | AI (source-diff): Promise/async transpilation in Svelte runtime, not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-DQXQ3vdz.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd--lcRUmPc.js | AI (source-diff): Promise/async transpilation in Svelte runtime, not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd--lcRUmPc.js | AI (source-diff): Standard Svelte/Vite minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-zHNWL0BM.cjs | AI (source-diff): Standard Svelte/Vite minified bundle output; consistent with publisher's established build pattern. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-BUHmQ4bm.cjs | AI (source-diff): False positive; network+exec pattern matches Svelte runtime fetch/Promise patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-Dv9H1vME.js | AI (source-diff): Standard Vite/Svelte minified bundle. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-Dcjz0B3u.js | AI (source-diff): Standard Vite/Svelte minified bundle. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-DBjwfb5b.cjs | AI (source-diff): Standard Vite/Svelte minified bundle. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-fV-zedcH.js | AI (source-diff): False positive; same Svelte runtime pattern. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-fV-zedcH.js | AI (source-diff): Standard Vite/Svelte minified bundle. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-DmF1pc4p.js | AI (source-diff): False positive; same Svelte runtime pattern. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-DmF1pc4p.js | AI (source-diff): Standard Vite/Svelte minified bundle. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-BUHmQ4bm.cjs | AI (source-diff): Standard Vite/Svelte minified bundle; hashed filename pattern consistent with build tooling across all versions. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-kvkTqATm.cjs | AI (source-diff): Network calls and dynamic code are Svelte runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-CEQES2b4.js | AI (source-diff): Standard Vite/Svelte minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-BF4gOAT0.js | AI (source-diff): Standard Vite/Svelte minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordSmsForm-incAvPee.cjs | AI (source-diff): Standard Vite/Svelte minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-CsvFloXQ.js | AI (source-diff): Svelte runtime patterns; not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-CsvFloXQ.js | AI (source-diff): Standard Vite/Svelte minified bundle output. | ai | |
| source-diff | net-exec-file:components/GeneralPlayerForgotPasswordFormNd-BvnyJJPf.js | AI (source-diff): Svelte runtime patterns; not malicious. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-BvnyJJPf.js | AI (source-diff): Standard Vite/Svelte minified bundle output. | ai | |
| source-diff | obfuscated-file:components/GeneralPlayerForgotPasswordFormNd-kvkTqATm.cjs | AI (source-diff): Standard Vite/Svelte minified bundle output; consistent with package purpose. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Scoped monorepo component package; sparse metadata is consistent across all 401 versions. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires inside Vaadin dev-mode detector bundle code; stable false positive for this package. | ai |
Versions (showing 51 of 110)
| Version | Deps | Published |
|---|---|---|
| 1.94.25 | 0 / 0 | |
| 1.94.24 | 0 / 0 | |
| 1.94.23 | 0 / 0 | |
| 1.94.22 | 0 / 0 | |
| 1.94.21 | 0 / 0 | |
| 1.94.20 | 0 / 0 | |
| 1.94.19 | 0 / 0 | |
| 1.94.18 | 0 / 0 | |
| 1.94.17 | 0 / 0 | |
| 1.94.16 | 0 / 0 | |
| 1.94.15 | 0 / 0 | |
| 1.94.9 | 0 / 0 | |
| 1.94.8 | 0 / 0 | |
| 1.94.7 | 0 / 0 | |
| 1.94.6 | 0 / 0 | |
| 1.94.5 | 0 / 0 | |
| 1.94.4 | 0 / 0 | |
| 1.94.3 | 0 / 0 | |
| 1.94.2 | 0 / 0 | |
| 1.94.1 | 0 / 0 | |
| 1.94.0 | 0 / 0 | |
| 1.93.15 | 0 / 0 | |
| 1.93.14 | 0 / 0 | |
| 1.93.13 | 0 / 0 | |
| 1.93.12 | 0 / 0 | |
| 1.93.11 | 0 / 0 | |
| 1.93.10 | 0 / 0 | |
| 1.93.9 | 0 / 0 | |
| 1.93.8 | 0 / 0 | |
| 1.93.7 | 0 / 0 | |
| 1.93.6 | 0 / 0 | |
| 1.93.5 | 0 / 0 | |
| 1.93.4 | 0 / 0 | |
| 1.93.3 | 0 / 0 | |
| 1.93.2 | 0 / 0 | |
| 1.93.1 | 0 / 0 | |
| 1.93.0 | 0 / 0 | |
| 1.92.8 | 0 / 0 | |
| 1.92.7 | 0 / 0 | |
| 1.92.6 | 0 / 0 | |
| 1.92.5 | 0 / 0 | |
| 1.92.4 | 0 / 0 | |
| 1.92.3 | 0 / 0 | |
| 1.92.2 | 0 / 0 | |
| 1.92.1 | 0 / 0 | |
| 1.92.0 | 0 / 0 | |
| 1.91.2 | 0 / 0 | |
| 1.91.1 | 0 / 0 | |
| 1.90.37 | 0 / 0 | |
| 1.90.36 | 0 / 0 | |
| 1.90.35 | 0 / 0 |
v1.94.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.24
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.23
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.22
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.21
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.15
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (goe.suta) than the most recent previously approved version (adrian.pripon) on 2026-05-26, but goe.suta is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.94.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.8
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.7
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.6
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.5
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.4
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.94.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.93.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.92.3
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.92.2
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.92.1
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.92.0
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.91.2
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.91.1
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.90.37
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.90.35
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.