@gapi/cli
Gapi command line interface
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:uninstall | AI (phantom-deps): Legacy dep in long-running CLI, no evidence of malicious use. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Same runner pattern, dual-use and expected in a CLI generator. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Used in CLI runner to shell out to build tools, expected for this package. | ai | |
| phantom-deps | phantom-dep:@angular-devkit/schematics | AI (phantom-deps): Official Angular tooling dep, expected for scaffolding CLI. | ai | |
| phantom-deps | phantom-dep:parcel-plugin-shebang | AI (phantom-deps): Parcel bundler plugin, consistent with build scripts. | ai | |
| phantom-deps | phantom-dep:@angular-devkit/core | AI (phantom-deps): Official Angular tooling dep, well-known and expected. | ai | |
| phantom-deps | phantom-dep:@rxdi/schematics | AI (phantom-deps): Angular schematics ecosystem dep, expected for scaffolding CLI. | ai | |
| phantom-deps | phantom-dep:shell-quote | AI (phantom-deps): Shell utility consistent with CLI's exec functionality. | ai | |
| phantom-deps | phantom-dep:node.extend | AI (phantom-deps): Utility dep, low risk for established CLI package. | ai | |
| phantom-deps | phantom-dep:mkdirp | AI (phantom-deps): Common utility used by CLI tooling, likely bundled/dynamic usage. | ai | |
| phantom-deps | phantom-dep:@angular-devkit/schematics-cli | AI (phantom-deps): Official Angular tooling dep, expected for scaffolding CLI. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Likely used in bundled dist not scanned by heuristic. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires in webpack bundle output, standard bundler pattern not eval-injection. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Standard CLI prompt lib, likely used in bundled/minified code. | ai | |
| dependencies | unvetted-dep:pkg | AI (dependencies): pkg is a well-known Vercel/zeit packaging tool, standard for CLI binaries. | ai | |
| phantom-deps | phantom-dep:systemjs | AI (phantom-deps): Referenced in config files as expected for this CLI; stable false positive. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): CLI tool uses chokidar for file watching via config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:node-notifier | AI (phantom-deps): Referenced in config files for notifications; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:@zeit/ncc | AI (phantom-deps): Build/bundle tool referenced in config; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:pkg | AI (phantom-deps): CLI tool that bundles/packages apps; pkg referenced in config files is expected usage pattern. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @gapi/cli is a scoped GraphQL CLI tool with 743 versions; edit-distance match to 'joi' is a false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads a user-supplied external options file (program.externalOptions); intentional CLI extension point, not arbitrary code injection. | ai | |
| phantom-deps | phantom-dep:@gapi/schematics | AI (phantom-deps): Same org scope; schematics used as a CLI sub-tool, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:graphql-document-collector | AI (phantom-deps): GraphQL tooling referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:apollo-codegen | AI (phantom-deps): GraphQL codegen tool invoked via CLI config; not directly imported but legitimately used. | ai |
Versions (showing 64 of 264)
| Version | Deps | Published |
|---|---|---|
| 1.2.28 | 15 / 4 | |
| 1.2.27 | 15 / 4 | |
| 1.2.26 | 15 / 4 | |
| 1.2.25 | 15 / 4 | |
| 1.2.24 | 15 / 4 | |
| 1.2.23 | 15 / 4 | |
| 1.2.22 | 15 / 4 | |
| 1.2.21 | 15 / 4 | |
| 1.2.19 | 15 / 4 | |
| 1.2.18 | 15 / 4 | |
| 1.2.17 | 15 / 4 | |
| 1.2.16 | 15 / 4 | |
| 1.2.15 | 15 / 4 | |
| 1.2.14 | 15 / 4 | |
| 1.2.13 | 15 / 4 | |
| 1.2.12 | 15 / 4 | |
| 1.2.11 | 15 / 4 | |
| 1.2.10 | 15 / 4 | |
| 1.2.9 | 15 / 4 | |
| 1.2.8 | 15 / 4 | |
| 1.2.7 | 15 / 4 | |
| 1.2.5 | 15 / 4 | |
| 1.2.4 | 15 / 4 | |
| 1.2.3 | 15 / 4 | |
| 1.2.2 | 15 / 4 | |
| 1.2.1 | 15 / 4 | |
| 1.2.0 | 15 / 4 | |
| 1.1.0 | 15 / 4 | |
| 1.0.36 | 12 / 5 | |
| 1.0.35 | 12 / 5 | |
| 1.0.34 | 12 / 5 | |
| 1.0.33 | 12 / 5 | |
| 1.0.32 | 12 / 5 | |
| 1.0.31 | 12 / 5 | |
| 1.0.30 | 12 / 5 | |
| 1.0.29 | 12 / 5 | |
| 1.0.28 | 12 / 5 | |
| 1.0.27 | 12 / 5 | |
| 1.0.26 | 12 / 5 | |
| 1.0.25 | 12 / 5 | |
| 1.0.24 | 12 / 5 | |
| 1.0.23 | 12 / 5 | |
| 1.0.22 | 12 / 5 | |
| 1.0.21 | 12 / 5 | |
| 1.0.20 | 12 / 5 | |
| 1.0.19 | 12 / 5 | |
| 1.0.18 | 12 / 5 | |
| 1.0.17 | 12 / 5 | |
| 1.0.16 | 12 / 5 | |
| 1.0.15 | 12 / 5 | |
| 1.0.14 | 12 / 5 | |
| 1.0.13 | 12 / 5 | |
| 1.0.12 | 12 / 5 | |
| 1.0.11 | 12 / 5 | |
| 1.0.10 | 12 / 5 | |
| 1.0.9 | 12 / 5 | |
| 1.0.7 | 12 / 5 | |
| 1.0.6 | 12 / 5 | |
| 1.0.5 | 12 / 5 | |
| 1.0.4 | 12 / 5 | |
| 1.0.3 | 12 / 5 | |
| 1.0.2 | 12 / 5 | |
| 1.0.1 | 12 / 5 | |
| 1.0.0 | 12 / 5 |
v1.2.28
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.26
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.25
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.24
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.23
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.21
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.17
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.16
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.14
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.13
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.12
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.8
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.5
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.4
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.2
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.0
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.0
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.36
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.35
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.34
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.31
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.28
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.25
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.21
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.20
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.18
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.17
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.14
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.13
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.9
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.7
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.6
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.5
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
4 findingsnew Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. > 1 | webpackJsonp([0],{"+3/4":function(t,e,n){"use strict";n.d(e,"a",function(){return i});var r=n("TToO"),i=function(t){func
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.