@harperfast/harper
39
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
dawsontothcb1kenobiharperdb_teamheskewjoshua_hdbkriszypethan_arrowood
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:studio/web/assets/index-B0RkMtGu.js | AI (source-diff): Bundled studio web app (vite/rolldown output), not obfuscation. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-CmtdFSpO.js | AI (source-diff): swagger-ui-react bundle; network+eval patterns are normal for this UI library. | ai | |
| source-diff | net-exec-file:studio/web/assets/status-BxBrA2jn.js | AI (source-diff): Bundled studio status page asset, not dropper behavior. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-BEQRCGgC.js | AI (source-diff): Bundled swagger-ui-react asset; network+eval patterns are bundler artifacts. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-DMe7ApA4.js | AI (source-diff): Vite bundled studio app entry, minified build output. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-xqZyR_fo.js | AI (source-diff): Bundled swagger-ui-react vendor library, not malicious. | ai | |
| source-diff | net-exec-file:studio/web/assets/status-CYIAVWVk.js | AI (source-diff): Studio bundle worker/network pattern, not exfil. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-D07pIqJt.js | AI (source-diff): Vite/rolldown bundled studio assets, not true obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-DL0ibcSu.js | AI (source-diff): Vite/rolldown bundled frontend asset with accompanying sourcemap; build output not obfuscation. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-DlKvzNvq.js | AI (source-diff): Bundled swagger-ui vendor chunk; fetch+eval is normal for API doc UI, not exfil. | ai | |
| source-diff | net-exec-file:studio/web/assets/status-BUdYwFrp.js | AI (source-diff): Bundled studio status page chunk; part of Harper's own web UI. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-D_ePI1A-.js | AI (source-diff): Vite bundle main chunk; minified build output with matching source map. | ai | |
| source-diff | net-exec-file:studio/web/assets/status-DiSReWae.js | AI (source-diff): Bundled studio app chunk. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-BYkbAX7E.js | AI (source-diff): Bundled swagger-ui vendor chunk. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-Bkmp74hd.js | AI (source-diff): Main bundled SPA chunk, build output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-uNnkOK6j.js | AI (source-diff): Bundled studio web UI output, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-BeDlmXju.js | AI (source-diff): Minified bundler output for profile-edit UI page, legitimate code. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-26y1EUMG.js | AI (source-diff): Minified bundler output, status dashboard chunk. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-CWeBJPXe.js | AI (source-diff): Minified bundler entrypoint for studio web app. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-CxTavHFE.js | AI (source-diff): Vite-bundled studio frontend asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-C-uokAal.js | AI (source-diff): Vite-bundled studio frontend asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-D6xeT4ss.js | AI (source-diff): Vite-bundled studio frontend asset, not obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): busboy/structon are established, purpose-fitting libs for multipart/schema handling. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-BJjklK4V.js | AI (source-diff): Vite-bundled studio frontend asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-ChxVrrli.js | AI (source-diff): Vite-bundled studio frontend asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-D77bwywc.js | AI (source-diff): Vite-bundled studio frontend asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-BFZovM68.js | AI (source-diff): Bundled Studio UI asset; minified, not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-DQBR5qBd.js | AI (source-diff): Vite/rolldown-bundled Studio UI asset; minified, not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-Dy4qT0vm.js | AI (source-diff): Bundled Studio UI asset; minified, not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/button-BqaHkv91.js | AI (source-diff): Bundled Studio UI asset; minified, not obfuscated. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-Cyct1o5I.js | AI (source-diff): Bundled vendor chunk with standard fetch/dynamic-import for SPA routing, not dropper behavior. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-DlC3nLj3.js | AI (source-diff): Bundled vendor chunk with standard fetch/dynamic-import for SPA routing, not dropper behavior. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-gjpePJuu.js | AI (source-diff): Vite-bundled studio UI asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-f5-e8ocl.js | AI (source-diff): Vite-bundled studio UI asset with import-map, not true obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-CmoVx0A5.js | AI (source-diff): Vite-bundled studio UI asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-qbLPhOzw.js | AI (source-diff): Vite-bundled studio frontend asset with sourcemap, not true obfuscation. | ai | |
| source-diff | net-exec-file:studio/web/assets/status-OG2bJLqw.js | AI (source-diff): Bundled UI chunk, not dropper/loader. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-SBlSkKkG.js | AI (source-diff): Bundled swagger-ui-react vendor chunk, dual-use false positive. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-DUfQJVk0.js | AI (source-diff): Vite-bundled studio frontend, not obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-fDIUHt_X.js | AI (source-diff): Bundled studio status/dashboard UI page, minified not obfuscated. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-9UzkyydK.js | AI (source-diff): Bundled React vendor chunk, standard bundler output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-CfwQpiKM.js | AI (source-diff): Bundled studio profile-edit UI page, minified not obfuscated. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-ZSCDRpol.js | AI (source-diff): Bundled vendor chart lib (viz), network calls are app API calls not exfil. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-tpQxqcfB.js | AI (source-diff): Vite-bundled studio UI asset with import map, minified build output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/button-B_oawaxm.js | AI (source-diff): Vite-bundled studio UI asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-DhLu-DHX.js | AI (source-diff): Bundled vite entry file with __vite__mapDeps helper, standard build output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-DSL-499E.js | AI (source-diff): Bundled frontend asset. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-BRW5QtzY.js | AI (source-diff): Vite/rolldown bundled studio frontend asset, not obfuscation. | ai | |
| source-diff | net-exec-file:studio/web/assets/ts.worker-aG3Cc-4f.js | AI (source-diff): Bundled Monaco ts.worker; network+eval are normal editor/language-service code. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-BA-5bmxI.js | AI (source-diff): Vite-bundled studio frontend asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/yaml.worker-dSPq-Bmt.js | AI (source-diff): Monaco editor worker bundle; minified build output, not obfuscation. | ai | |
| source-diff | net-exec-file:studio/web/assets/status-DnjXvTm4.js | AI (source-diff): Studio UI bundle; no concrete malicious destination identified. | ai | |
| source-diff | net-exec-file:studio/web/assets/swagger-ui-react-RvewIpx8.js | AI (source-diff): swagger-ui-react vendor bundle; base64 helpers are library code. | ai | |
| source-diff | net-exec-file:studio/web/assets/ts.worker-DmlNd5GY.js | AI (source-diff): Bundled monaco worker; network+eval patterns are library internals, not malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/css.worker-BERHMMy7.js | AI (source-diff): Monaco editor worker bundle; minified build output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/ts.worker-DmlNd5GY.js | AI (source-diff): Monaco TS worker bundle; minified build output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-voeNsl4C.js | AI (source-diff): Bundled frontend asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-Tv7e9k8K.js | AI (source-diff): Vite/rolldown bundled studio frontend asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-110CCE-v.js | AI (source-diff): Bundled frontend asset, minified not obfuscated. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Same trusted publisher org adding a team member maintainer. | ai | |
| source-diff | obfuscated-file:studio/web/assets/katex-CddkPoXu.js | AI (source-diff): KaTeX bundled library, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:studio/web/assets/gitGraphDiagram-IHSO6WYX-CTrpWhSb.js | AI (source-diff): Bundled mermaid diagram lib, minified. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-core-B_nm7aY2.js | AI (source-diff): Bundled axios/http vendor chunk for the studio web UI, no destination exfil found. | ai | |
| source-diff | obfuscated-file:studio/web/assets/sankeyDiagram-HTMAVEWB-D8y1J8O8.js | AI (source-diff): Bundled mermaid diagram lib, minified frontend asset not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/diagram-G47NLZAW-DE0AsAnA.js | AI (source-diff): Bundled mermaid diagram lib, minified frontend asset. | ai | |
| source-diff | obfuscated-file:studio/web/assets/quadrantDiagram-ABIIQ3AL-BkBWmbrS.js | AI (source-diff): Bundled mermaid diagram lib, minified. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-7-bH4Dg3.js | AI (source-diff): Vite-minified studio status page chunk; readable logic visible in sample. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-WCta5cFe.js | AI (source-diff): Vite-minified studio profile page chunk; readable form logic visible in sample. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-BjwD_EXc.js | AI (source-diff): Vite-minified studio app bundle; long lines are normal for minified output. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-1vGw6eGc.js | AI (source-diff): Standard Vite-bundled React UI asset for HarperDB Studio; minification is expected. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-DQa37TIR.js | AI (source-diff): Standard Vite-bundled React UI asset for HarperDB Studio; minification is expected. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-DI-LWtGo.js | AI (source-diff): Standard Vite-bundled React UI asset for HarperDB Studio; minification is expected. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-DX5mq9gw.js | AI (source-diff): Minified Vite output for studio UI; readable logic visible in sample, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-DEbcplKh.js | AI (source-diff): Minified Vite output for studio UI; standard bundled imports, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-DwYg6LpK.js | AI (source-diff): Minified Vite output for studio UI; readable React component logic in sample, not malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-DfcUUI7w.js | AI (source-diff): Minified Vite studio UI entry chunk; standard bundled frontend. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-IcGoxtBp.js | AI (source-diff): Minified Vite studio UI profile page chunk; standard bundled frontend. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-CxrkcGr7.js | AI (source-diff): Minified Vite studio UI chunk; content is recognizable React component code. | ai | |
| source-diff | obfuscated-file:studio/web/assets/button-Nyh_djVh.js | AI (source-diff): Minified Vite studio UI chunk; long lines are normal for bundled frontend code. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-DSi8mF-Y.js | AI (source-diff): Vite-bundled React vendor chunk; standard frontend bundle. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-core-D9powGyb.js | AI (source-diff): Vite-bundled axios/core vendor chunk; standard HTTP client, not malware. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-misc-Ca8iItyG.js | AI (source-diff): Vite-bundled frontend vendor chunk containing Floating UI and similar OSS libs. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-Bu6T8W_w.js | AI (source-diff): Vite-bundled frontend vendor chunk; network calls are axios HTTP client, not dropper behavior. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-Dk_TRrUg.js | AI (source-diff): Minified Vite bundle for studio UI; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-wyN1K1z0.js | AI (source-diff): Minified Vite bundle for studio UI; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-ChrCqVc7.js | AI (source-diff): Minified Vite bundle for studio UI; not obfuscated malware. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-BdK5B9uw.js | AI (source-diff): Mermaid/viz vendor bundle; network+exec pattern is standard module loading in bundled frontend code. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-D6IIT0sT.js | AI (source-diff): React vendor bundle; standard bundled frontend code. | ai | |
| dependencies | unvetted-dep:validate.js | AI (dependencies): validate.js 0.13.1 is a pinned, well-known validation library; no known CVEs at this version for this package's use case. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-Dj1rnUQ4.js | AI (source-diff): Vite-bundled React vendor bundle; standard UI library code. | ai | |
| source-diff | obfuscated-file:studio/web/assets/button-V4IQ8FFq.js | AI (source-diff): Minified Vite build output for Studio UI button component. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-BrfTnnpt.js | AI (source-diff): Minified Vite build output for Studio UI status page. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-Dyrp-ZIJ.js | AI (source-diff): Minified Vite build output for Studio UI profile page. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-BIjBsaWw.js | AI (source-diff): Minified Vite build output for Studio UI; long lines are expected in bundled frontend assets. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-misc-DKMU5hOJ.js | AI (source-diff): Vite-bundled frontend vendor bundle; standard UI library code. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-core-f32UXcS5.js | AI (source-diff): Vite-bundled frontend vendor bundle; standard axios/HTTP client code in UI layer. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-Db_2kM67.js | AI (source-diff): Vite-bundled frontend asset; network calls are axios/fetch in UI code, not dropper behavior. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-BftP-yQ8.js | AI (source-diff): Vite-bundled studio frontend; minified JS is expected for this web UI asset across all versions. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-KVqwJsbk.js | AI (source-diff): Standard Vite-bundled React UI asset; minification is expected for studio web assets. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-C3fPIb_V.js | AI (source-diff): Vite vendor bundle for React; network+eval pattern is standard bundler output, not malware. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-misc-Bj3r0doz.js | AI (source-diff): Vite vendor bundle (floating-ui etc.); network+eval pattern is standard bundler output, not malware. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-core-8FI3Cbaa.js | AI (source-diff): Vite vendor bundle (axios/core libs); network+eval pattern is standard bundler output, not malware. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-morXXTZA.js | AI (source-diff): Vite vendor bundle for visualization libs; network+eval pattern is standard bundler output, not malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/button-b8IkGZ_9.js | AI (source-diff): Standard Vite-bundled React UI asset; minification is expected for studio web assets. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-DAsdweRg.js | AI (source-diff): Standard Vite-bundled React UI asset; minification is expected for studio web assets. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-CKW3SZJG.js | AI (source-diff): Standard Vite-bundled React UI asset; minification is expected for studio web assets. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-react-DyY32duL.js | AI (source-diff): Vite-bundled frontend vendor chunk; standard minified ES module imports, not a dropper. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-viz-Cs-GQIim.js | AI (source-diff): Vite-bundled frontend vendor chunk; standard minified ES module imports, not a dropper. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-core-DlDjzdYO.js | AI (source-diff): Vite-bundled frontend vendor chunk; standard minified ES module imports, not a dropper. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in bundled vendor code is standard JS runtime usage, not evasion. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are Vite-built frontend assets with source maps; expected for a studio UI update. | ai | |
| source-diff | obfuscated-file:studio/web/assets/profile-CFSLl1du.js | AI (source-diff): Standard Vite minified bundle; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/status-BAnbW0Rq.js | AI (source-diff): Standard Vite minified bundle; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-4WybhUdn.js | AI (source-diff): Standard Vite minified bundle with source map; not obfuscated malware. | ai | |
| source-diff | net-exec-file:studio/web/assets/vendor-misc-DiaKLG2J.js | AI (source-diff): Vite-bundled frontend vendor chunk; standard minified ES module imports, not a dropper. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-Dq1Ma4KE.js | AI (source-diff): Standard Vite-bundled web UI asset with source map; not malicious obfuscation. Expected pattern for this package's studio frontend. | ai | |
| phantom-deps | phantom-dep:pino | AI (phantom-deps): Declared runtime dep referenced in config files; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:human-readable-ids | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:node-stream-zip | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@datadog/pprof | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:cli-progress | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:ulidx | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| source-diff | obfuscated-file:studio/web/assets/index-C0And10y.js | AI (source-diff): Vite-bundled web UI asset with accompanying .map sourcemap; standard minification for a studio dashboard, not malicious obfuscation. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding of application payload tarballs is expected for a deployment platform. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): jsLoader.ts is a documented module loader; dynamic require is the core feature, not a risk. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Database/application platform legitimately uses child_process for stop/start lifecycle management. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Platform spawns child processes for git/system ops; spreading process.env for subprocess environment is standard practice. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in cryptoHash.js is standard AES decryption (IV + ciphertext), not obfuscation. | ai |
Versions (showing 39 of 39)
| Version | Deps | Published |
|---|---|---|
| 5.1.18 | 80 / 36 | |
| 5.1.14 | 80 / 34 | |
| 5.1.12 | 80 / 34 | |
| 5.1.10 | 80 / 34 | |
| 5.1.9 | 80 / 34 | |
| 5.1.8 | 80 / 34 | |
| 5.1.6 | 80 / 34 | |
| 5.1.5 | 80 / 34 | |
| 5.1.4 | 80 / 34 | |
| 5.1.3 | 80 / 34 | |
| 5.1.1 | 80 / 34 | |
| 5.1.0 | 80 / 34 | |
| 5.0.32 | 80 / 31 | |
| 5.0.31 | 80 / 31 | |
| 5.0.29 | 80 / 31 | |
| 5.0.28 | 80 / 31 | |
| 5.0.26 | 80 / 31 | |
| 5.0.23 | 80 / 31 | |
| 5.0.22 | 80 / 31 | |
| 5.0.21 | 80 / 31 | |
| 5.0.20 | 80 / 31 | |
| 5.0.19 | 80 / 31 | |
| 5.0.18 | 80 / 31 | |
| 5.0.17 | 80 / 31 | |
| 5.0.15 | 80 / 31 | |
| 5.0.14 | 80 / 31 | |
| 5.0.12 | 80 / 31 | |
| 5.0.11 | 80 / 31 | |
| 5.0.10 | 80 / 31 | |
| 5.0.9 | 80 / 31 | |
| 5.0.8 | 80 / 31 | |
| 5.0.7 | 80 / 31 | |
| 5.0.6 | 80 / 31 | |
| 5.0.5 | 80 / 31 | |
| 5.0.4 | 80 / 31 | |
| 5.0.3 | 80 / 31 | |
| 5.0.2 | 80 / 31 | |
| 5.0.1 | 80 / 31 | |
| 5.0.0 | 80 / 31 |
v5.1.18
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.32
7 findings
HIGH
New obfuscated file: studio/web/assets/sankeyDiagram-HTMAVEWB-D8y1J8O8.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/diagram-G47NLZAW-DE0AsAnA.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/katex-CddkPoXu.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: studio/web/assets/vendor-core-B_nm7aY2.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
New obfuscated file: studio/web/assets/quadrantDiagram-ABIIQ3AL-BkBWmbrS.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/gitGraphDiagram-IHSO6WYX-CTrpWhSb.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.18
4 findings
HIGH
New obfuscated file: studio/web/assets/index-Tv7e9k8K.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/status-110CCE-v.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/profile-voeNsl4C.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.17
4 findings
HIGH
New obfuscated file: studio/web/assets/status-BRW5QtzY.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/profile-DSL-499E.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/index-DhLu-DHX.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.12
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.9
2 findings
HIGH
New obfuscated file: studio/web/assets/index-DL0ibcSu.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.6
2 findings
HIGH
New obfuscated file: studio/web/assets/index-qbLPhOzw.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.5
2 findings
HIGH
New obfuscated file: studio/web/assets/index-D07pIqJt.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.3
4 findings
HIGH
New obfuscated file: studio/web/assets/index-CxTavHFE.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/status-D6xeT4ss.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/profile-C-uokAal.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.2
4 findings
HIGH
New obfuscated file: studio/web/assets/profile-gjpePJuu.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/status-CmoVx0A5.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: studio/web/assets/index-f5-e8ocl.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.