@fullcalendar/vue3
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:chunks/623d1736.d.ts | AI (source-diff): Bundled .d.ts type declarations with long lines, not true obfuscation. | ai | |
| dependencies | unvetted-dep:@full-ui/headless-calendar | AI (dependencies): First-party sibling package from the same FullCalendar v7 rewrite, pinned exact version. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used in Vue reactivity proxy wrapper, not evasive code. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Expected from major v7 architecture rewrite bundling preact/headless-calendar. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 7.0.2 | 3 / 0 | |
| 7.0.1 | 3 / 0 | |
| 7.0.0 | 3 / 0 | |
| 6.1.21 | 0 / 17 | |
| 6.1.20 | 0 / 17 | |
| 6.1.19 | 0 / 17 | |
| 6.1.18 | 0 / 17 | |
| 6.1.17 | 0 / 17 | |
| 6.1.15 | 0 / 17 | |
| 6.1.14 | 0 / 17 | |
| 6.1.13 | 0 / 17 | |
| 6.1.12 | 0 / 17 |
v7.0.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.