@gencode/agents
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/loader-CGp_n4m8.d.ts | AI (source-diff): Type declarations, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/loader-CVsd42rJ.d.ts | AI (source-diff): Type declaration file, not code; false positive on line length. | ai | |
| source-diff | obfuscated-file:dist/system-runtime-g4RJ5wzA.js | AI (source-diff): Bundled build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/system-runtime-CpWEW04p.js | AI (source-diff): Bundled minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/session-BpKaF-Gk.js | AI (source-diff): Bundled minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/goal-store-M3_Nx3ky.js | AI (source-diff): Bundled minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/default-provider-BV9gmV00.js | AI (source-diff): Bundled minified build output, not obfuscation; matches tsdown/rolldown build. | ai | |
| source-diff | obfuscated-file:dist/loader-Cf-Eh3Kg.d.ts | AI (source-diff): Type declaration file, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/loader-D9_1WNPg.d.ts | AI (source-diff): Type declaration file, not code; long lines are normal for generated .d.ts. | ai | |
| source-diff | obfuscated-file:dist/system-runtime-7UR4nDc0.js | AI (source-diff): Minified bundler output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/loader-BaSEPp0a.d.ts | AI (source-diff): Type declaration file, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/system-runtime-BwN5oJYF.js | AI (source-diff): Bundled build output, provider/runtime wiring. | ai | |
| source-diff | obfuscated-file:dist/session-RhwZxWME.js | AI (source-diff): Bundled build output, session file helpers. | ai | |
| source-diff | obfuscated-file:dist/goal-store-CGUkaQtk.js | AI (source-diff): Bundled build output, benign fs/session logic. | ai | |
| source-diff | obfuscated-file:dist/default-provider-DeT3IzGN.js | AI (source-diff): Minified bundler output (rolldown/tsdown), no malicious behavior in sample. | ai | |
| source-diff | obfuscated-file:dist/goal-store-CmMXXTIZ.js | AI (source-diff): Bundled build output, no malicious behavior. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): First-party sibling packages from same org, not unvetted third parties. | ai | |
| source-diff | obfuscated-file:dist/loader-DSY3mHib.d.ts | AI (source-diff): Type declaration file, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/system-runtime-DfAhRq2L.js | AI (source-diff): Bundled build output, no malicious behavior. | ai | |
| source-diff | obfuscated-file:dist/session-CvZsdTZJ.js | AI (source-diff): Bundled build output, no malicious behavior. | ai | |
| source-diff | obfuscated-file:dist/host-BC9sAhdH.js | AI (source-diff): Bundled build output, no malicious behavior. | ai | |
| source-diff | obfuscated-file:dist/default-provider-DchVtHkL.js | AI (source-diff): Bundled build output, not obfuscation; standard fs/path/crypto usage. | ai | |
| source-diff | obfuscated-file:dist/loader-CR0TB17A.d.ts | AI (source-diff): generated .d.ts type declarations | ai | |
| source-diff | obfuscated-file:dist/loader-CWpoiWtT.d.ts | AI (source-diff): generated .d.ts type declaration, not obfuscation | ai | |
| source-diff | obfuscated-file:dist/session-DbQpczup.js | AI (source-diff): rolldown/tsdown minified bundle output, not obfuscation | ai | |
| source-diff | obfuscated-file:dist/host-CQ2BhNzZ.js | AI (source-diff): rolldown/tsdown minified bundle output, not obfuscation | ai | |
| source-diff | obfuscated-file:dist/goal-store-DKeFVjM4.js | AI (source-diff): rolldown/tsdown minified bundle output, not obfuscation | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-Bv6TuIMf.js | AI (source-diff): rolldown/tsdown minified bundle output, not obfuscation | ai | |
| source-diff | obfuscated-file:dist/session-CDlm6Wb9.js | AI (source-diff): Rolldown bundle output; readable session management code, no obfuscation indicators. | ai | |
| source-diff | obfuscated-file:dist/goal-store-BVIfUlil.js | AI (source-diff): Rolldown bundle output; semantically clear goal-store logic, no obfuscation indicators. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-D1PnLyOZ.js | AI (source-diff): Rolldown bundle output with long lines; code is readable ESM, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/loader-DWYoarsH.d.ts | AI (source-diff): TypeScript declaration file with long lines from many type exports; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/session-DIkujhuw.js | AI (source-diff): Rolldown/tsdown bundled output; code is readable and benign. | ai | |
| source-diff | obfuscated-file:dist/host-CFCi5RZa.js | AI (source-diff): Rolldown/tsdown bundled output; code is readable and benign. | ai | |
| source-diff | obfuscated-file:dist/goal-store-Clnnb4f2.js | AI (source-diff): Rolldown/tsdown bundled output; code is readable and benign. | ai | |
| source-diff | obfuscated-file:dist/default-provider-QJ5I3qOU.js | AI (source-diff): Rolldown/tsdown bundled output; code is readable and benign. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-Zyp3W8uT.js | AI (source-diff): Rolldown bundle output; minified but readable, no malicious patterns. Stable for this package's build toolchain. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-DweGOw8P.js | AI (source-diff): File is a rolldown-bundled ESM output with readable logic; long lines are from minification, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/session-CpVlUp8c.js | AI (source-diff): Rolldown bundler output; code is readable minified ESM with no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/goal-store-DvL6FpJV.js | AI (source-diff): Rolldown bundler output; code is readable minified ESM with no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-Dz2XUj1H.js | AI (source-diff): Rolldown bundler output; code is readable minified ESM with no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-BX9aHHJK.js | AI (source-diff): Standard rollup/tsdown bundle output; code is readable and benign, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-muN6YtZb.js | AI (source-diff): File is rollup/tsdown bundle output (hashed chunk name, readable ESM logic); not obfuscated malware. | ai | |
| phantom-deps | phantom-dep:better-sqlite3 | AI (phantom-deps): Used transitively via bundled dist; phantom-dep heuristic fires but dep is clearly used in bundle. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-CuBb3DYN.js | AI (source-diff): Rolldown/tsdown minified bundle output; readable logic in sample, no malicious patterns. | ai | |
| phantom-deps | phantom-dep:@types/better-sqlite3 | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| source-diff | obfuscated-file:dist/goal-store-C_oLLqTK.js | AI (source-diff): Rolldown/tsdown minified bundle output; readable goal-store logic in sample, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/session-D9x-WDl8.js | AI (source-diff): Rolldown/tsdown minified bundle output; readable session management logic in sample, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/goal-store-1Lewl_Xz.js | AI (source-diff): Rolldown bundler output; goal store logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-DVFQMfYl.js | AI (source-diff): Rolldown bundler output; minified but readable file I/O logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/session-B26JETSt.js | AI (source-diff): Rolldown bundler output; session management logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/session-BDGOSbwC.js | AI (source-diff): Rolldown-bundled ESM output; content is readable session management logic, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-CXE7L9HO.js | AI (source-diff): Rolldown-bundled ESM output; content is readable file/memory management logic, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/goal-store-B36KsoVO.js | AI (source-diff): Rolldown-bundled ESM output; content is readable goal-store logic, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-DMxBOIZn.js | AI (source-diff): Rolldown bundle output; readable logic with node: imports, no obfuscation or malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-Bhzb_o53.js | AI (source-diff): Rolldown bundler output; code is readable minified ESM with no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/session-CiekMEUQ.js | AI (source-diff): Rolldown bundler output; session management logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/goal-store-DxaeZmiE.js | AI (source-diff): Rolldown bundler output; goal store file I/O logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/goal-store-C_Z3P5Cg.js | AI (source-diff): Rolldown-bundled ESM output; samples show goal store CRUD logic, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-PIpf9WYR.js | AI (source-diff): Rolldown-bundled ESM output; samples show legitimate file I/O and session logic, not obfuscation. | ai | |
| phantom-deps | phantom-dep:@huggingface/transformers | AI (phantom-deps): ML library used via config/peer pattern in an AI agents package; phantom-dep is a false positive here. | ai | |
| source-diff | obfuscated-file:dist/session-MBebUrjk.js | AI (source-diff): Rolldown-bundled ESM output; samples show session management logic, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-_CdSlTJE.js | AI (source-diff): Standard rollup/tsdown bundle output; sample shows readable ESM logic, not obfuscation. | ai | |
| phantom-deps | phantom-dep:lz-string | AI (phantom-deps): lz-string is visibly used in the bundled dist for session-storage compression. | ai | |
| phantom-deps | phantom-dep:log4js | AI (phantom-deps): Bundled dist; imports inlined by tsdown bundler, not directly visible as top-level imports. | ai | |
| source-diff | obfuscated-file:dist/builtin-provider-Bv7sulLa.js | AI (source-diff): Rolldown-generated bundle with readable code; long lines are minified but not obfuscated. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:isbinaryfile | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:gray-matter | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:sqlite-vec | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:openai | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:jiti | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:ajv | AI (phantom-deps): Config-driven dependency; stable pattern for this package. | ai |
Versions (showing 60 of 60)
| Version | Deps | Published |
|---|---|---|
| 0.17.2 | 13 / 5 | |
| 0.17.1 | 13 / 5 | |
| 0.17.0 | 13 / 5 | |
| 0.16.4 | 12 / 5 | |
| 0.16.3 | 12 / 5 | |
| 0.16.2 | 12 / 5 | |
| 0.16.1 | 12 / 5 | |
| 0.16.0 | 12 / 5 | |
| 0.15.0 | 12 / 5 | |
| 0.14.0 | 12 / 5 | |
| 0.13.0 | 12 / 5 | |
| 0.12.1 | 12 / 5 | |
| 0.12.0 | 12 / 5 | |
| 0.11.0 | 12 / 5 | |
| 0.10.14 | 12 / 5 | |
| 0.10.13 | 12 / 5 | |
| 0.10.12 | 12 / 5 | |
| 0.10.11 | 12 / 5 | |
| 0.10.10 | 12 / 5 | |
| 0.10.9 | 12 / 5 | |
| 0.10.8 | 12 / 5 | |
| 0.10.7 | 12 / 5 | |
| 0.10.6 | 12 / 5 | |
| 0.10.4 | 12 / 5 | |
| 0.10.3 | 12 / 5 | |
| 0.10.2 | 12 / 5 | |
| 0.10.1 | 12 / 5 | |
| 0.10.0 | 12 / 5 | |
| 0.9.3 | 12 / 5 | |
| 0.9.2 | 12 / 5 | |
| 0.9.1 | 12 / 5 | |
| 0.9.0 | 12 / 5 | |
| 0.8.3 | 11 / 5 | |
| 0.8.2 | 11 / 5 | |
| 0.8.1 | 11 / 5 | |
| 0.8.0 | 11 / 5 | |
| 0.7.7 | 11 / 5 | |
| 0.7.6 | 11 / 5 | |
| 0.7.5 | 11 / 5 | |
| 0.7.4 | 11 / 5 | |
| 0.7.3 | 11 / 5 | |
| 0.7.2 | 11 / 5 | |
| 0.7.1 | 13 / 5 | |
| 0.7.0 | 13 / 5 | |
| 0.6.2 | 11 / 5 | |
| 0.6.1 | 11 / 5 | |
| 0.6.0 | 11 / 5 | |
| 0.5.0 | 12 / 6 | |
| 0.4.0 | 11 / 5 | |
| 0.3.2 | 11 / 5 | |
| 0.3.1 | 11 / 5 | |
| 0.3.0 | 11 / 5 | |
| 0.2.4 | 10 / 5 | |
| 0.2.3 | 10 / 5 | |
| 0.2.2 | 10 / 5 | |
| 0.2.1 | 10 / 5 | |
| 0.2.0 | 10 / 5 | |
| 0.1.2 | 10 / 5 | |
| 0.1.1 | 10 / 5 | |
| 0.1.0 | 10 / 5 |
v0.17.2
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.1
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.4
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.3
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.