@gjsify/webgl
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/esm/context/shader-program/introspection.js | AI (source-diff): Rolldown-minified ESM bundle; content is standard WebGL API implementation, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:lib/esm/context/texture-management/tex-image.js | AI (source-diff): Rolldown-minified ESM bundle; content is standard WebGL texImage2D logic using GdkPixbuf. | ai | |
| source-diff | obfuscated-file:lib/esm/context/shader-program/uniforms.js | AI (source-diff): Rolldown-minified ESM bundle; content is standard WebGL uniform setter logic. | ai | |
| source-diff | obfuscated-file:lib/esm/context/shader-program/shader-lifecycle.js | AI (source-diff): Rolldown-minified ESM bundle; content is standard WebGL shader lifecycle logic. | ai | |
| source-diff | obfuscated-file:lib/esm/context/shader-program/program-lifecycle.js | AI (source-diff): Rolldown-minified ESM bundle; content is standard WebGL program lifecycle logic. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher is a legitimate automation pattern for this established gjsify org package. | ai | |
| source-diff | obfuscated-file:lib/esm/context/state.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/context/texture-management.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/webgl-context-base.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/webgl1.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL spec tests. | ai | |
| source-diff | obfuscated-file:lib/esm/webgl2-context/instanced-and-framebuffer-ops.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL2 implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/webgl2-context/object-lifecycle.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL2 implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/attribs.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests, not malicious. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/buffers.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/context.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/programs.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/rendering.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/state.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/textures.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/conformance/uniforms.spec.js | AI (source-diff): Rolldown-minified ESM test bundle; content is plainly WebGL conformance tests. | ai | |
| source-diff | obfuscated-file:lib/esm/context/buffer-binding.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/context/drawing.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/context/framebuffer.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| source-diff | obfuscated-file:lib/esm/context/shader-program.js | AI (source-diff): Rolldown-minified ESM library bundle; content is WebGL implementation code. | ai | |
| phantom-deps | phantom-dep:glsl-tokenizer | AI (phantom-deps): Referenced in config files, not directly imported; consistent with build-time usage pattern. | ai | |
| phantom-deps | phantom-dep:bit-twiddle | AI (phantom-deps): Referenced in config files, not directly imported; consistent with build-time usage pattern. | ai | |
| phantom-deps | phantom-dep:@gjsify/event-bridge | AI (phantom-deps): Same-org package; indirect usage via gjsify toolchain is expected. | ai | |
| phantom-deps | phantom-dep:@gjsify/dom-events | AI (phantom-deps): Same-org package; indirect usage via gjsify toolchain is expected. | ai | |
| phantom-deps | phantom-dep:@gjsify/utils | AI (phantom-deps): Same-org package used indirectly via gjsify build toolchain; not a direct import by design. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt .so files are the documented native binding output for this GJS WebGL library; consistent across versions. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 0.4.36 | 10 / 5 | |
| 0.4.26 | 9 / 5 | |
| 0.4.21 | 9 / 5 | |
| 0.4.19 | 9 / 5 | |
| 0.4.0 | 8 / 5 | |
| 0.3.17 | 8 / 5 | |
| 0.3.14 | 8 / 5 | |
| 0.3.11 | 8 / 5 | |
| 0.3.9 | 8 / 5 | |
| 0.3.8 | 8 / 5 | |
| 0.3.7 | 8 / 5 | |
| 0.3.6 | 8 / 5 | |
| 0.3.1 | 8 / 5 | |
| 0.3.0 | 8 / 5 | |
| 0.2.0 | 8 / 5 | |
| 0.1.9 | 8 / 5 | |
| 0.1.5 | 8 / 5 | |
| 0.1.0 | 8 / 5 |
v0.4.36
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.26
20 findingsThis version was published by a different npm account than previous versions on 2026-05-26. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.21
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.19
18 findingsThis version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.17
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.14
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.11
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.9
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.8
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.7
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.6
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.1
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.0
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-ppc64/libgwebgl.so • prebuilds/linux-riscv64/libgwebgl.so • prebuilds/linux-s390x/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.9
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.5
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
2 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/linux-aarch64/libgwebgl.so • prebuilds/linux-x86_64/libgwebgl.so
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.