@finos/legend-application-pure-ide-deployment
Legend Pure IDE web application deployment
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/ide/static/index.e5014f7c.js | AI (source-diff): Browser SPA bundle; network calls and dynamic code are normal for a Legend IDE web app. | ai | |
| source-diff | obfuscated-file:dist/ide/static/index.e5014f7c.js | AI (source-diff): Webpack-bundled frontend app; minified dist files are expected for this deployment package. | ai | |
| source-diff | obfuscated-file:dist/ide/static/index.5c459215.js | AI (source-diff): Webpack-minified frontend bundle; expected artifact for this deployment package. | ai | |
| source-diff | net-exec-file:dist/ide/static/index.5c459215.js | AI (source-diff): Network calls and dynamic execution are normal in a React SPA bundle; no dropper indicators in the sample. | ai | |
| source-diff | net-exec-file:dist/ide/static/index.ff37b04f.js | AI (source-diff): Network calls + dynamic module loading are expected in a bundled SPA; no dropper behavior evident in the sample. | ai | |
| source-diff | obfuscated-file:dist/ide/static/index.ff37b04f.js | AI (source-diff): Webpack-minified frontend bundle for a FINOS web app; stable pattern across all versions of this deployment package. | ai | |
| source-diff | obfuscated-file:dist/ide/static/index.e084b6fc.js | AI (source-diff): Standard webpack-minified frontend bundle for a FINOS Legend web app; not obfuscation. | ai | |
| source-diff | net-exec-file:dist/ide/static/index.e084b6fc.js | AI (source-diff): Network calls + dynamic module loading are normal in a React SPA bundle; no dropper behavior present. | ai | |
| phantom-deps | phantom-dep:@finos/legend-art | AI (phantom-deps): Same-org dep in deployment bundle; phantom-dep heuristic is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Type-only dependency; loaded by convention in TS projects. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Deployment bundle; react declared for bundling, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@finos/legend-application | AI (phantom-deps): Same-org dep in deployment bundle; phantom-dep heuristic is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@finos/legend-application-pure-ide | AI (phantom-deps): Same-org dep in deployment bundle; phantom-dep heuristic is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@finos/legend-lego | AI (phantom-deps): Same-org dep in deployment bundle; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 13.220.0 | 6 / 11 | |
| 13.219.0 | 6 / 11 | |
| 13.216.0 | 6 / 11 | |
| 13.213.0 | 6 / 11 | |
| 13.211.0 | 6 / 11 |
v13.220.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.219.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.216.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.213.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.