@flarehr/salpac-cars-calculator
Flare Cars Calculator
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/energy-flex-cars-calculator.js | AI (source-diff): Standard Vite/Preact minified bundle output; consistent with multi-config build pipeline. | ai | |
| source-diff | net-exec-file:dist/energy-flex-cars-calculator.js | AI (source-diff): Network calls and dynamic patterns are Preact vdom internals in minified bundle, not malware. | ai | |
| source-diff | obfuscated-file:dist/byd-cars-calculator.js | AI (source-diff): Standard Vite/Preact minified bundle output; consistent across all versions of this package. | ai | |
| source-diff | net-exec-file:dist/byd-cars-calculator.js | AI (source-diff): Network calls and dynamic patterns are part of Preact's vdom runtime, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/flare-cars-calculator.js | AI (source-diff): Standard Vite/Preact minified bundle output; consistent across all versions of this package. | ai | |
| source-diff | net-exec-file:dist/flare-cars-calculator.js | AI (source-diff): Network calls and dynamic patterns are part of Preact's vdom runtime, not dropper behavior. | ai | |
| phantom-deps | phantom-dep:@emotion/styled | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-hook-form | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@heroicons/react | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Bundled output package; deps declared in package.json but consumed via build artifacts, not direct imports. | ai | |
| phantom-deps | phantom-dep:preact-custom-element | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-highlight-words | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:smoothscroll-polyfill | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@headlessui/react | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:preact | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@emotion/css | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@emotion/cache | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@emotion/react | AI (phantom-deps): Same bundled output pattern; stable false positive for this package. | ai |
Versions (showing 51 of 337)
| Version | Deps | Published |
|---|---|---|
| 1.0.1563 | 13 / 43 | |
| 1.0.1562 | 13 / 43 | |
| 1.0.1561 | 13 / 43 | |
| 1.0.1560 | 13 / 43 | |
| 1.0.1559 | 13 / 43 | |
| 1.0.1558 | 13 / 43 | |
| 1.0.1557 | 13 / 43 | |
| 1.0.1556 | 13 / 43 | |
| 1.0.1555 | 13 / 43 | |
| 1.0.1554 | 13 / 43 | |
| 1.0.1552 | 13 / 43 | |
| 1.0.1551 | 13 / 43 | |
| 1.0.1550 | 13 / 43 | |
| 1.0.1549 | 13 / 43 | |
| 1.0.1548 | 13 / 43 | |
| 1.0.1547 | 13 / 43 | |
| 1.0.1546 | 13 / 43 | |
| 1.0.1545 | 13 / 43 | |
| 1.0.1544 | 13 / 43 | |
| 1.0.1543 | 13 / 43 | |
| 1.0.1542 | 13 / 43 | |
| 1.0.1541 | 13 / 43 | |
| 1.0.1540 | 13 / 43 | |
| 1.0.1539 | 13 / 43 | |
| 1.0.1538 | 13 / 43 | |
| 1.0.1537 | 13 / 43 | |
| 1.0.1536 | 13 / 43 | |
| 1.0.1534 | 13 / 43 | |
| 1.0.1533 | 13 / 43 | |
| 1.0.1532 | 13 / 43 | |
| 1.0.1531 | 13 / 43 | |
| 1.0.1530 | 13 / 43 | |
| 1.0.1529 | 13 / 43 | |
| 1.0.1528 | 13 / 43 | |
| 1.0.1527 | 13 / 43 | |
| 1.0.1526 | 13 / 43 | |
| 1.0.1525 | 13 / 43 | |
| 1.0.1524 | 13 / 43 | |
| 1.0.1523 | 13 / 43 | |
| 1.0.1522 | 13 / 43 | |
| 1.0.1521 | 13 / 43 | |
| 1.0.1520 | 13 / 43 | |
| 1.0.1519 | 13 / 43 | |
| 1.0.1518 | 13 / 43 | |
| 1.0.1517 | 13 / 43 | |
| 1.0.1516 | 13 / 43 | |
| 1.0.1515 | 13 / 43 | |
| 1.0.1514 | 13 / 43 | |
| 1.0.1513 | 13 / 43 | |
| 1.0.1512 | 13 / 43 | |
| 1.0.1511 | 13 / 43 |
v1.0.1563
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1562
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1561
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1560
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1559
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1558
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1557
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1556
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1555
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1554
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1552
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1551
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1550
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1549
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1548
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1547
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1546
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1545
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1544
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1543
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1542
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1541
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1540
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1539
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1538
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1537
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1536
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1534
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1533
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1532
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1531
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1530
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1529
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1528
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1527
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1526
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1525
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1524
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1523
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1522
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1521
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1520
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1519
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1518
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1517
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1516
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1515
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1514
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1513
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1512
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1511
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.