← Home

@fairyhunter13/opentui-core

npm Repository Homepage

OpenTUI is a TypeScript library on a native Zig core for building terminal user interfaces (TUIs)

40
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

fairyhunter13

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:index-1mm3bk73.js AI (source-diff): Bun-bundled output (// @bun header); minified build artifact, not obfuscation. Stable pattern for this package. ai
source-diff obfuscated-file:index-6qxkvx1n.js AI (source-diff): Bun-bundled output (// @bun header); minification is expected for this package's build pipeline. ai
source-diff obfuscated-file:index-7xsz0ndw.js AI (source-diff): Bun bundler output with accompanying source maps; minified build artifact, not obfuscation. ai
source-diff obfuscated-file:index-jct3zgy3.js AI (source-diff): Bun-bundled output; // @bun header and standard ESM boilerplate confirm legitimate build artifact, not obfuscation. ai
source-diff obfuscated-file:index-g2c8aqza.js AI (source-diff): Bun-bundled output (// @bun header); minified build artifact, not obfuscation. Stable pattern for this package. ai
source-diff obfuscated-file:index-t3rrpex7.js AI (source-diff): Bun-bundled output; minification is expected for this package's build pipeline. ai
source-diff obfuscated-file:index-ptcgzdnp.js AI (source-diff): Bun-bundled output (// @bun header); minified build artifact with source maps, not malicious obfuscation. ai
source-diff obfuscated-file:index-w7h7gtsh.js AI (source-diff): Bun-bundled output (// @bun header); minified lines are expected build artifacts for this package. ai
source-diff obfuscated-file:index-pr4swpf9.js AI (source-diff): Bun-bundled output (// @bun header); minification is expected for this compiled TUI library. ai
source-diff obfuscated-file:index-c4vtensm.js AI (source-diff): Bun bundler output (// @bun header); minified build artifact, not obfuscation. ai
source-diff obfuscated-file:index-n2b7w731.js AI (source-diff): Bun-bundled output (// @bun header); minified build artifact, not obfuscation. Stable pattern for this package. ai
source-diff obfuscated-file:index-dcj62y8t.js AI (source-diff): Bun-bundled output (// @bun header); minification is expected for this compiled TUI library. ai
source-diff obfuscated-file:index-p0v1qbn9.js AI (source-diff): Bun bundler output; minified build artifact is expected for this package. ai
source-diff obfuscated-file:index-cs6ygy1c.js AI (source-diff): Bun-bundled output (// @bun header); expected minified artifact for this TUI library. ai
source-diff obfuscated-file:index-tse8gzh0.js AI (source-diff): Bun-bundled output (// @bun header); minified large files are expected for this TUI library. ai
semgrep semgrep:env-bulk-read AI (semgrep): Fires in test cleanup code filtering TEST_-prefixed keys only; not a data exfiltration risk. ai
source-diff obfuscated-file:index-cbt8k699.js AI (source-diff): Bun-bundled output; // @bun header and standard ESM boilerplate confirm legitimate build artifact. ai
source-diff obfuscated-file:index-dnchmavt.js AI (source-diff): Bun bundler output (// @bun header); minified build artifact, not obfuscation. Stable pattern for this package. ai
phantom-deps phantom-dep:diff AI (phantom-deps): diff is a declared runtime dependency; likely bundled into the distributed output. ai
phantom-deps phantom-dep:jimp AI (phantom-deps): jimp is a declared runtime dependency; likely bundled into the distributed output. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get() used inside a Proxy get trap — idiomatic JS pattern, not obfuscation. Stable for this package. ai

Versions (showing 40 of 40)

Version Deps Published
0.1.142 5 / 6
0.1.141 5 / 6
0.1.140 5 / 6
0.1.139 5 / 6
0.1.138 5 / 6
0.1.137 5 / 6
0.1.136 5 / 6
0.1.135 5 / 6
0.1.134 5 / 6
0.1.133 5 / 6
0.1.132 5 / 6
0.1.131 5 / 6
0.1.130 5 / 6
0.1.129 5 / 6
0.1.128 5 / 6
0.1.127 5 / 6
0.1.126 5 / 6
0.1.125 5 / 6
0.1.124 5 / 6
0.1.123 5 / 6
0.1.122 5 / 6
0.1.121 5 / 6
0.1.120 5 / 6
0.1.119 5 / 6
0.1.118 5 / 6
0.1.117 5 / 6
0.1.116 5 / 6
0.1.115 5 / 6
0.1.114 5 / 6
0.1.113 5 / 6
0.1.112 5 / 6
0.1.111 5 / 6
0.1.110 5 / 6
0.1.109 5 / 6
0.1.108 5 / 6
0.1.107 5 / 6
0.1.106 5 / 6
0.1.105 5 / 6
0.1.104 5 / 6
0.1.103 5 / 6

v0.1.141

2 findings
HIGH New obfuscated file: index-jct3zgy3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.140

2 findings
HIGH New obfuscated file: index-jct3zgy3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.139

2 findings
HIGH New obfuscated file: index-n2b7w731.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.138

2 findings
HIGH New obfuscated file: index-n2b7w731.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.137

2 findings
HIGH New obfuscated file: index-n2b7w731.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.136

2 findings
HIGH New obfuscated file: index-n2b7w731.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.135

2 findings
HIGH New obfuscated file: index-n2b7w731.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.134

2 findings
HIGH New obfuscated file: index-n2b7w731.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.133

2 findings
HIGH New obfuscated file: index-cs6ygy1c.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.132

2 findings
HIGH New obfuscated file: index-t3rrpex7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.131

2 findings
HIGH New obfuscated file: index-t3rrpex7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.130

2 findings
HIGH New obfuscated file: index-pr4swpf9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.129

2 findings
HIGH New obfuscated file: index-w7h7gtsh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.128

2 findings
HIGH New obfuscated file: index-1mm3bk73.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.127

2 findings
HIGH New obfuscated file: index-ptcgzdnp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.126

2 findings
HIGH New obfuscated file: index-6qxkvx1n.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.125

2 findings
HIGH New obfuscated file: index-6qxkvx1n.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.124

2 findings
HIGH New obfuscated file: index-c4vtensm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.123

2 findings
HIGH New obfuscated file: index-c4vtensm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.122

2 findings
HIGH New obfuscated file: index-c4vtensm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.121

2 findings
HIGH New obfuscated file: index-7xsz0ndw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.120

2 findings
HIGH New obfuscated file: index-g2c8aqza.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.119

2 findings
HIGH New obfuscated file: index-p0v1qbn9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.118

2 findings
HIGH New obfuscated file: index-cbt8k699.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.117

2 findings
HIGH New obfuscated file: index-dcj62y8t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.116

2 findings
HIGH New obfuscated file: index-dcj62y8t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.115

3 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fairyhunter13.

HIGH New obfuscated file: index-tse8gzh0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.114

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fairyhunter13.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.113

2 findings
HIGH New obfuscated file: index-dcj62y8t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.112

3 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: fairyhunter13.

HIGH New obfuscated file: index-tse8gzh0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.111

2 findings
HIGH New obfuscated file: index-dcj62y8t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.110

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.109

2 findings
HIGH New obfuscated file: index-dnchmavt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.108

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.107

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.106

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.105

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.104

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.103

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.