@gorgo/medusa-1c
Medusa plugin for integration with 1C:Enterprise
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:.medusa/server/src/workflows/onec-import-workflow.js | AI (source-diff): Standard TS-compiled Medusa workflow code; long lines from chained SDK calls. | ai | |
| source-diff | obfuscated-file:.medusa/server/src/api/1c/exchange/route.js | AI (source-diff): Standard TS-compiled route handler with CommonJS helpers; not obfuscated. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from manual to GitHub Actions CI/CD publishing with SLSA provenance. | ai | |
| source-diff | obfuscated-file:.medusa/server/src/utils/parsing/bitrix-offers-parser.js | AI (source-diff): Standard TS-compiled JS with long lines from nested Russian XML tag arrays; not obfuscated. | ai | |
| source-diff | obfuscated-file:.medusa/server/src/workflows/onec-offers-workflow.js | AI (source-diff): Standard TS-compiled Medusa workflow code; not obfuscated. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): lodash is in dependencies and devDependencies; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Decoding HTTP Basic Auth header — standard auth pattern, not a malicious payload. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 0.1.9 | 5 / 21 | |
| 0.1.4 | 4 / 27 | |
| 0.1.2 | 4 / 27 | |
| 0.1.1 | 4 / 27 | |
| 0.1.0 | 4 / 27 | |
| 0.0.15 | 3 / 26 | |
| 0.0.14 | 3 / 26 | |
| 0.0.11 | 3 / 26 | |
| 0.0.9 | 3 / 26 | |
| 0.0.5 | 3 / 26 | |
| 0.0.4 | 3 / 26 | |
| 0.0.3 | 3 / 26 | |
| 0.0.2 | 3 / 26 |
v0.1.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
6 findingsThis version was published by a different npm account than previous versions on 2026-04-17. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.