@gjsify/crypto
8
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jumplinkschanzewlsh
Keywords
gjsnodecrypto
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/esm/browser.js | AI (source-diff): Rolldown bundle re-exporting browser crypto polyfill modules; readable and benign. | ai | |
| source-diff | obfuscated-file:lib/esm/aes-primitives.js | AI (source-diff): Rolldown-bundled ESM output; content is AES S-box tables and standard crypto primitives, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:lib/esm/nativescript/stubs.js | AI (source-diff): NativeScript stub file throwing ENOTSUP errors; no malicious content. | ai | |
| source-diff | obfuscated-file:lib/esm/browser/stubs.js | AI (source-diff): Stub file that throws ENOTSUP errors for unsupported browser APIs; entirely benign. | ai | |
| source-diff | obfuscated-file:lib/esm/browser/ecdh.js | AI (source-diff): Rolldown-bundled ECDH implementation with standard curve parameters; no malicious content. | ai | |
| source-diff | obfuscated-file:lib/esm/browser/cipher.js | AI (source-diff): Rolldown-bundled AES cipher wrapper over WebCrypto SubtleCrypto; content is legitimate. | ai | |
| phantom-deps | phantom-dep:@noble/hashes | AI (phantom-deps): @noble/hashes is a legitimate declared runtime dep used in build config; phantom-dep heuristic false positive. | ai | |
| phantom-deps | phantom-dep:@girs/glib-2.0 | AI (phantom-deps): Referenced in config files per finding; not a direct import but a legitimate transitive/type dependency. | ai | |
| phantom-deps | phantom-dep:@gjsify/utils | AI (phantom-deps): Same org scope; likely re-exported or used indirectly via build tooling, consistent with sibling packages. | ai | |
| dependencies | unvetted-dep:@girs/glib-2.0 | AI (dependencies): @girs/glib-2.0 is a GLib type binding, appropriate for a GJS-targeted crypto polyfill. | ai | |
| typosquat | typosquat.levenshtein:bcrypt | AI (typosquat): Scoped @gjsify/crypto is a GJS crypto polyfill, not a typosquat of bcrypt. | ai | |
| phantom-deps | phantom-dep:@gjsify/stream | AI (phantom-deps): Same-org transitive dep; phantom-dep heuristic is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:@gjsify/buffer | AI (phantom-deps): Same-org transitive dep; phantom-dep heuristic is a false positive for this package. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in cipher test vectors is expected in a crypto library; not obfuscation. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): PEM/DER parsing in a crypto library legitimately uses base64 decoding; not a malicious payload. | ai |