@feedmepos/mf-inventory-portal
27
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
victor.chailokingweidanielmcfluffy
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/netsuite-9qEVrdMv.js | AI (source-diff): Bundled axios calls to package's own configured backend URL, not exfil. | ai | |
| source-diff | obfuscated-file:dist/app-DYMYQwvV.js | AI (source-diff): Vite/rollup bundled output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/netsuite-BTxEJ6gl.js | AI (source-diff): Bundled vendor code calling package's own configured backend URLs. | ai | |
| source-diff | obfuscated-file:dist/app-C7EmXSeQ.js | AI (source-diff): Vite/Rollup bundled app code, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-B0rs949d.js | AI (source-diff): Bundled build output calling package's own configured backend. | ai | |
| source-diff | obfuscated-file:dist/index-DO4GBTOR.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | obfuscated-file:dist/app-D1BdwMzz.js | AI (source-diff): Vite/Rollup bundled build output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-DzExCwvo.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | net-exec-file:dist/netsuite-DnDj1l4p.js | AI (source-diff): Network calls target package's own configured backend URL, not exfil. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-DG8rR0ha.js | AI (source-diff): Bundled build artifact embedding CI env vars, not obfuscation/malware. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-DVM3qSu0.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | obfuscated-file:dist/netsuite-DnDj1l4p.js | AI (source-diff): Bundled build output including lodash, calls first-party backend. | ai | |
| source-diff | net-exec-file:dist/netsuite-CM1xsb3Q.js | AI (source-diff): Network calls go to package's own configured backend, no exec of fetched code. | ai | |
| source-diff | obfuscated-file:dist/netsuite-CM1xsb3Q.js | AI (source-diff): Bundled lodash + app code, benign. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-DsrlA0VP.js | AI (source-diff): CI build env dump embedded by bundler, not malicious. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-w4fp4oT4.js | AI (source-diff): Bundled Vue component chunk. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-CAjxn-PC.js | AI (source-diff): Bundled Vue component chunk calling own backend URL. | ai | |
| source-diff | obfuscated-file:dist/index-BosCKut7.js | AI (source-diff): Bundled build chunk, standard minification. | ai | |
| source-diff | obfuscated-file:dist/app-BM6mngFA.js | AI (source-diff): Vite/rollup bundled output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-B3VXqLxq.js | AI (source-diff): Bundled store module, calls own backend. | ai | |
| source-diff | net-exec-file:dist/netsuite-ojatCiHQ.js | AI (source-diff): First-party integration module calling documented backend API. | ai | |
| source-diff | net-exec-file:dist/jszip.min-UvNpneu6.js | AI (source-diff): jszip vendor bundle, standard library code not a loader. | ai | |
| source-diff | net-exec-file:dist/EmailDialog.vue_vue_type_script_setup_true_lang-D3tETd4M.js | AI (source-diff): Bundled UI component using normal axios/vue calls, no dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/app-jwcH8Mn8.js | AI (source-diff): Bundled Vite/Vue output, not true obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): jszip is a well-known, widely used library added for legitimate export feature. | ai | |
| source-diff | net-exec-file:dist/netsuite-Cm4tUcLt.js | AI (source-diff): Bundled integration module calling app's own backend APIs. | ai | |
| source-diff | net-exec-file:dist/jszip.min-k8R8v9tK.js | AI (source-diff): jszip minified bundle; network+exec pattern is bundler artifact. | ai | |
| source-diff | net-exec-file:dist/EmailDialog.vue_vue_type_script_setup_true_lang-CE9wwNB_.js | AI (source-diff): Bundled Vue component using axios for app's own API, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/app-CnwVdB-r.js | AI (source-diff): Vite-bundled Vue app output, not true obfuscation. | ai | |
| phantom-deps | phantom-dep:jszip | AI (phantom-deps): Bundled dep used indirectly via build tooling, common in monorepo apps. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-C_5XKtMn.js | AI (source-diff): Minified bundle output. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-CQvQIvR-.js | AI (source-diff): Minified bundle output. | ai | |
| source-diff | net-exec-file:dist/netsuite-B9XrL1RC.js | AI (source-diff): Network calls target app's own configured backend, not external host. | ai | |
| source-diff | obfuscated-file:dist/netsuite-B9XrL1RC.js | AI (source-diff): Minified bundle containing bundled lodash, calls own backend URL. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-DIKTKc_1.js | AI (source-diff): Minified bundle output; embeds CI env dump, not exfil. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-D2_2A1ve.js | AI (source-diff): Minified bundle output. | ai | |
| source-diff | obfuscated-file:dist/index-DGxWBGVv.js | AI (source-diff): Minified bundle output. | ai | |
| source-diff | obfuscated-file:dist/app-DTBAhC9s.js | AI (source-diff): Vite/esbuild minified bundle, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/app-DYlZ2yhl.js | AI (source-diff): Vite/Rollup bundled build output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/netsuite-BplkxMY_.js | AI (source-diff): Calls package's own configured NetSuite/inventory backend URLs, not exfil. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-B7xHV5Y6.js | AI (source-diff): Bundled build artifact containing CI env dump, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-C_Y3_I_8.js | AI (source-diff): Bundled Vue component code. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-BsY4Ca2E.js | AI (source-diff): Bundled Vue component code. | ai | |
| source-diff | obfuscated-file:dist/index-DU4iyU3D.js | AI (source-diff): Bundled build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/app-D3gm3Lsw.js | AI (source-diff): Vite/rollup bundle output, readable Vue/vendor code, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/netsuite-DmXOUJo-.js | AI (source-diff): Axios calls target package's own configured backend URL, not exfil destination. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-BKxLIZg6.js | AI (source-diff): Bundled first-party API client code. | ai | |
| source-diff | obfuscated-file:dist/netsuite-DmXOUJo-.js | AI (source-diff): Bundled lodash + first-party API client code. | ai | |
| source-diff | obfuscated-file:dist/index-D_u-AkFp.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-CEDkdeWc.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | net-exec-file:dist/netsuite-CPUKn7UQ.js | AI (source-diff): Network calls target package's own configured backend, no dynamic exec of remote code. | ai | |
| source-diff | obfuscated-file:dist/netsuite-CPUKn7UQ.js | AI (source-diff): Bundled lodash + first-party API calls, not malicious. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-D_hfcDPc.js | AI (source-diff): Bundled build output with embedded CI env vars, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-DWbHZdc4.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-Dh5ZPJK-.js | AI (source-diff): Bundled build output, calls own configured backend URLs. | ai | |
| source-diff | obfuscated-file:dist/app-BEJm79K1.js | AI (source-diff): Vite/Rollup minified bundle, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/netsuite-CkGOciZz.js | AI (source-diff): Network calls target package's own configured backend, not exfil destination. | ai | |
| source-diff | obfuscated-file:dist/netsuite-CkGOciZz.js | AI (source-diff): Bundled chunk with lodash license header, standard minified output. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-CwJecjsN.js | AI (source-diff): CI env var dump baked into bundle, not obfuscation/malware. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-C2MenVog.js | AI (source-diff): Bundled Vue component chunk. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-Dm7oV3f2.js | AI (source-diff): Bundled Vue component chunk calling package's own backend URLs. | ai | |
| source-diff | obfuscated-file:dist/index-CZNCrbvL.js | AI (source-diff): Bundled chunk, standard build output. | ai | |
| source-diff | obfuscated-file:dist/app-BYizx2TA.js | AI (source-diff): Vite/rollup bundled Vue app output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-DjRmYzhJ.js | AI (source-diff): Bundled Vue store module. | ai | |
| source-diff | net-exec-file:dist/jszip.min-OgbweCQi.js | AI (source-diff): Bundled jszip library, network+eval pattern is normal for zip/minifier code. | ai | |
| source-diff | net-exec-file:dist/EmailDialog.vue_vue_type_script_setup_true_lang-BbIMtGt6.js | AI (source-diff): Bundled Vue component calling first-party backend APIs, no dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/app-CMmw-R61.js | AI (source-diff): Vite/Rollup bundle output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/netsuite-CmQmhpsr.js | AI (source-diff): First-party Netsuite integration module, not a loader. | ai | |
| source-diff | net-exec-file:dist/lodash-D9rnJgGZ.js | AI (source-diff): False positive: lodash template/Function usage + app HTTP calls, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/app-BtIUZZer.js | AI (source-diff): Standard Vite minified bundle for this internal portal; consistent across versions. | ai | |
| source-diff | obfuscated-file:dist/index-CKErlM6H.js | AI (source-diff): Vite chunk; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-D-7q6p_s.js | AI (source-diff): Vite chunk; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-ByvhMaCO.js | AI (source-diff): Vite chunk; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-BEB7pV9M.js | AI (source-diff): Vite chunk; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/lodash-D9rnJgGZ.js | AI (source-diff): Bundled lodash 4.17.21 UMD; MIT-licensed, clearly identified in file header. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-DfpzUsNl.js | AI (source-diff): Vite chunk; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-B7MCWj08.js | AI (source-diff): Standard Vite minified Vue component bundle. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-xOeZ1dcl.js | AI (source-diff): Vite-bundled output; CI env var leak is a build hygiene issue, not a security threat. | ai | |
| source-diff | obfuscated-file:dist/lodash-BrwnA6r2.js | AI (source-diff): Bundled lodash 4.17.21 with MIT license header; standard Vite code-splitting. | ai | |
| source-diff | net-exec-file:dist/lodash-BrwnA6r2.js | AI (source-diff): False positive on bundled lodash; no actual network+exec dropper pattern present. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-BMkVjCEy.js | AI (source-diff): Standard Vite minified Vue component bundle. | ai | |
| source-diff | obfuscated-file:dist/app-BPfT1Di5.js | AI (source-diff): Standard Vite minified bundle for internal FeedMe micro-frontend; readable Vue/Pinia code in samples. | ai | |
| source-diff | obfuscated-file:dist/index-DnDQuIzj.js | AI (source-diff): Standard Vite minified bundle; sample shows normal ES module re-exports. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-Bmff-FkE.js | AI (source-diff): Standard Vite minified Vue component bundle. | ai | |
| source-diff | obfuscated-file:dist/lodash-PCSvaIXr.js | AI (source-diff): Minified lodash 4.17.21 with MIT license header; standard Vite vendor chunk. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-B2h72dXO.js | AI (source-diff): Vite chunk; env vars embedded from GitHub Actions CI build, consistent with legitimate CI pipeline. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-BXiSzB-N.js | AI (source-diff): Vite chunk; standard minified Vue component bundle. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-DclCC5r6.js | AI (source-diff): Vite chunk; imports from org-internal modules, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/index-DkhSxroI.js | AI (source-diff): Vite chunk with readable code; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/app-BYsl6Q0k.js | AI (source-diff): Standard Vite minified bundle for this SPA; readable identifiers and org-internal imports confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-CBK89oKb.js | AI (source-diff): Vite chunk with readable CRUD API calls to org backend; no malicious patterns. | ai | |
| source-diff | net-exec-file:dist/lodash-PCSvaIXr.js | AI (source-diff): False positive; lodash uses Function constructor internally for template compilation, not for network-fetched code execution. | ai | |
| phantom-deps | phantom-dep:@feedmepos/feature-flag | AI (phantom-deps): Same-org scope; phantom dep pattern stable for this micro-frontend. | ai | |
| phantom-deps | phantom-dep:vue-country-flag-next | AI (phantom-deps): Config-referenced phantom dep; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@codemirror/lang-json | AI (phantom-deps): Config-referenced phantom dep; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/typescript-estree | AI (phantom-deps): Config-referenced dev tooling phantom dep; stable pattern. | ai | |
| phantom-deps | phantom-dep:libphonenumber-js | AI (phantom-deps): Org-internal micro-frontend; phantom deps are config-referenced, stable pattern across versions. | ai | |
| phantom-deps | phantom-dep:@feedmepos/inventory-core-js | AI (phantom-deps): Same-org scope; phantom dep pattern stable for this micro-frontend. | ai | |
| dependencies | unvetted-dep:@feedmepos/netsuite-core | AI (dependencies): Same-org internal dependency. | ai | |
| provenance | no-provenance | AI (provenance): Internal org package; provenance not expected in this publishing workflow. | ai | |
| dependencies | unvetted-dep:@feedmepos/inventory-core-dart | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/inventory-core-js | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/custom-attributes | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/inventory-core-2 | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/inventory-core | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/zod-inventory | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/feature-flag | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/menu | AI (dependencies): Same-org internal dependency. | ai | |
| dependencies | unvetted-dep:@feedmepos/core | AI (dependencies): Same-org internal dependency; consistent with feedmepos monorepo pattern. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): Established templating library; ^4.7.8 is the patched line. | ai | |
| dependencies | unvetted-dep:xlsx | AI (dependencies): Well-known spreadsheet library; no active advisory affecting this constraint. | ai | |
| source-diff | net-exec-file:dist/lodash-DKmhfMJj.js | AI (source-diff): Lodash UMD bundle; Function() use is lodash's template engine, not malware. Stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/app-D9p-rdE3.js | AI (source-diff): Standard Vite minified bundle; readable imports and structure confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/index-B_GTpER9.js | AI (source-diff): Standard Vite minified bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/IntegrationExplorerView-B_uw3hNL.js | AI (source-diff): Standard Vite minified bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/IntegrationView-DZUeTXN6.js | AI (source-diff): Standard Vite minified bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/inventory-core-dart.default-CkY4Tsyv.js | AI (source-diff): Vite bundle with embedded CI env snapshot; no credentials or exfiltration, stable false positive. | ai | |
| source-diff | obfuscated-file:dist/lodash-DKmhfMJj.js | AI (source-diff): Lodash UMD bundle; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/predefined-templates-CS9U9npp.js | AI (source-diff): Standard Vite minified bundle; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Large internal Vue app; deps declared for bundler/config use, not direct imports. | ai | |
| phantom-deps | phantom-dep:node-html-parser | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vue/cli-service | AI (phantom-deps): Framework-scoped build tool; loaded by convention. | ai | |
| phantom-deps | phantom-dep:@types/dinero.js | AI (phantom-deps): Type-only dep; framework-scoped, not directly imported. | ai | |
| phantom-deps | phantom-dep:html2pdf.js | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:google-maps | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:eventsource | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:change-case | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:handlebars | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:codemirror | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:lz-string | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:dompurify | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:dinero.js | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:vue-i18n | AI (phantom-deps): Framework convention; loaded by plugin, not direct import. | ai | |
| phantom-deps | phantom-dep:debounce | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:csstype | AI (phantom-deps): Type-only dep; not directly imported in source. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Config-level declaration; stable false positive. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Build-time env config; not a direct import. | ai | |
| phantom-deps | phantom-dep:fuzzy | AI (phantom-deps): Config-level declaration; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:dayjs | AI (phantom-deps): Same pattern — config-level declaration in a bundled micro-frontend. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 1.6.3 | 44 / 30 | |
| 1.6.2 | 44 / 30 | |
| 1.6.1 | 44 / 30 | |
| 1.6.0 | 43 / 30 | |
| 1.5.16 | 43 / 30 | |
| 1.5.15 | 43 / 30 | |
| 1.5.14 | 43 / 30 | |
| 1.5.13 | 43 / 30 | |
| 1.5.12 | 43 / 30 | |
| 1.5.11 | 43 / 30 | |
| 1.5.10 | 43 / 30 | |
| 1.5.9 | 43 / 30 | |
| 1.5.8 | 43 / 30 | |
| 1.5.7 | 43 / 30 | |
| 1.5.6 | 43 / 30 | |
| 1.5.5 | 43 / 30 | |
| 1.5.4 | 43 / 30 | |
| 1.5.3 | 43 / 30 | |
| 1.5.2 | 43 / 30 | |
| 1.5.1 | 43 / 30 | |
| 1.5.0 | 43 / 30 | |
| 1.4.4 | 43 / 30 | |
| 1.4.3 | 43 / 30 | |
| 1.4.2 | 43 / 30 | |
| 1.4.1 | 43 / 30 | |
| 1.4.0 | 43 / 30 | |
| 1.3.16 | 42 / 30 |