@hpcc-js/observablehq-compiler

hpcc-js - ObservableHQ Compiler (unoffical)

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

hpcc-js

Keywords

observablehqmarkdownobservablecompilerinterpreterrenderer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/index-Dg2jQBIA.js	AI (source-diff): Minified bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-DCkNfE2E.js	AI (source-diff): Minified bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-COQTb7t_.js	AI (source-diff): Minified Lezer HTML parser bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-C0WTq6je.js	AI (source-diff): Minified Lezer parser runtime bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-BjI7I3K0.js	AI (source-diff): Minified Lezer Python parser bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-7PV71_ts.js	AI (source-diff): Minified Lezer parser bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/highlight-CtvrxX31.js	AI (source-diff): Minified syntax highlighting bundle (CodeMirror/Lezer); standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/md-CM5UsfTf.js	AI (source-diff): Minified markdown bundle; standard build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-CYQKv1-1.js	AI (source-diff): Minified Markdown/Lezer parser bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/duckdb-ZQnOaRxt.js	AI (source-diff): Minified DuckDB-wasm integration bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-BldIoRTz.js	AI (source-diff): Minified CSS/Lezer parser bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/highlight-BKaxK3bG.js	AI (source-diff): Minified Lezer/CodeMirror highlight bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-COraVSsF.js	AI (source-diff): Minified JS/Lezer parser bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/md-DjeRApKy.js	AI (source-diff): Minified Markdown bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-fK6zQvHp.js	AI (source-diff): Minified bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-DniPFbo8.js	AI (source-diff): Minified bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-D5SuUF53.js	AI (source-diff): Minified HTML/Lezer parser bundle; legitimate build artifact.	ai	2026/06/01
source-diff	obfuscated-file:dist/index-DdKlQzon.js	AI (source-diff): Minified Lezer CSS parser; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/duckdb-B8Nsdq8W.js	AI (source-diff): Standard Vite-bundled minified output of @duckdb/duckdb-wasm; not obfuscation.	ai	2026/05/31
source-diff	obfuscated-file:dist/highlight-CFtcTZHe.js	AI (source-diff): Minified Lezer/CodeMirror highlight library; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/index-B6ZW_ztj.js	AI (source-diff): Minified Lezer HTML parser bundle; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/index-BFKeSKC_.js	AI (source-diff): Minified Lezer parser runtime; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/index-BLCWtR7X.js	AI (source-diff): Minified Lezer Python parser; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/index-DycSYo5y.js	AI (source-diff): Minified Lezer JS/TS parser; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/index-OHOn4Cvw.js	AI (source-diff): Minified Lezer Markdown parser; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/md-DqUzR4VS.js	AI (source-diff): Minified markdown bundle; legitimate build artifact.	ai	2026/05/31
source-diff	obfuscated-file:dist/md-DUaFUKbi.js	AI (source-diff): Minified bundle of @sindresorhus/slugify and transliterate; region comments confirm legitimate dependency bundling.	ai	2026/05/31
source-diff	obfuscated-file:dist/dist-HSOoLE8A.js	AI (source-diff): Minified bundle of @lezer/javascript; region comments and code structure confirm legitimate dependency bundling.	ai	2026/05/31
source-diff	obfuscated-file:dist/dist-DF_mUoJg.js	AI (source-diff): Minified bundle of @lezer/html; region comments and code structure confirm legitimate dependency bundling.	ai	2026/05/31
source-diff	obfuscated-file:dist/dist-C66WUAXi.js	AI (source-diff): Minified bundle of @lezer/python; region comments and code structure confirm legitimate dependency bundling.	ai	2026/05/31
source-diff	obfuscated-file:dist/dist-C3tBoEnV.js	AI (source-diff): Minified bundle of @lezer/css; region comments and code structure confirm legitimate dependency bundling.	ai	2026/05/31
source-diff	obfuscated-file:dist/md-Bxvu6Hld.js	AI (source-diff): Minified markdown processing bundle; legitimate build artifact.	ai	2026/05/30
source-diff	net-exec-file:dist/node/index.js	AI (source-diff): Same as index.cjs — core compiler functionality, not malware.	ai	2026/05/30
source-diff	net-exec-file:dist/node/index.cjs	AI (source-diff): Network+exec pattern is the core compiler functionality: dynamic import() and new Function() for Observable cell compilation.	ai	2026/05/30
source-diff	obfuscated-file:dist/index-COHaJzee.js	AI (source-diff): Minified bundled parser (LRParser/CodeMirror); legitimate build artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/node/index.js	AI (source-diff): Standard minified build output; no malicious patterns.	ai	2026/05/30
source-diff	obfuscated-file:dist/node/index.cjs	AI (source-diff): Standard minified build output for an ObservableHQ compiler; code is legitimate parser/compiler logic.	ai	2026/05/30
source-diff	obfuscated-file:dist/index-DNwLE6Kk.js	AI (source-diff): Minified bundled JS parser; legitimate build artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/index-D3TL70UM.js	AI (source-diff): Minified bundled CSS parser; legitimate build artifact.	ai	2026/05/30
semgrep	semgrep:shady-links-tlds	AI (semgrep): URL appears in a test fixture as mock user data, not in runtime code; no C2/exfil risk.	ai	2026/05/18
dependencies	unvetted-dep:@hpcc-js/observable-shim	AI (dependencies): Same @hpcc-js org as this package; trusted publisher with clean track record.	ai	2026/05/18
semgrep	semgrep:new-function-constructor	AI (semgrep): Core compiler mechanism for evaluating ObservableHQ notebook cells; inherent to this package's purpose across all versions.	ai	2026/05/07

Versions (showing 19 of 19)

Version	Deps	Published
3.8.2	2 / 7	2026-06-01
3.8.1	2 / 7	2026-05-29
3.8.0	2 / 7	2026-05-29
3.7.13	2 / 7	2026-05-29
3.7.12	2 / 5	2026-05-18
3.7.11	2 / 5	2026-05-02
3.7.9	2 / 5	2026-04-07
3.5.1	2 / 5	2025-09-04
3.5.0	2 / 5	2025-09-04
3.4.0	2 / 6	2025-08-26
3.3.9	1 / 3	2025-07-24
3.3.8	1 / 3	2025-07-04
3.3.7	1 / 3	2025-07-04
3.3.6	1 / 3	2025-07-04
3.3.5	1 / 3	2025-07-04
3.3.4	1 / 3	2025-07-04
3.3.3	1 / 3	2025-07-03
3.3.2	1 / 3	2025-06-24
1.5.1	3 / 3	2026-02-11

v3.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.8.1

6 findings

HIGH New obfuscated file: dist/dist-C3tBoEnV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-C66WUAXi.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-DF_mUoJg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-HSOoLE8A.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/md-DUaFUKbi.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.8.0

6 findings

HIGH New obfuscated file: dist/dist-C3tBoEnV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-C66WUAXi.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-DF_mUoJg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-HSOoLE8A.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/md-DUaFUKbi.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.7.13

6 findings

HIGH New obfuscated file: dist/dist-C3tBoEnV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-C66WUAXi.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-DF_mUoJg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/dist-HSOoLE8A.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/md-DUaFUKbi.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.7.12

10 findings

HIGH New obfuscated file: dist/duckdb-B8Nsdq8W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/highlight-CFtcTZHe.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-B6ZW_ztj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-BFKeSKC_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-BLCWtR7X.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-DdKlQzon.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-DycSYo5y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-OHOn4Cvw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/md-DqUzR4VS.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.7.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.7.9

14 findings

HIGH New obfuscated file: dist/node/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/node/index.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/duckdb-ZQnOaRxt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/highlight-BKaxK3bG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-BldIoRTz.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-COraVSsF.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-CYQKv1-1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-D5SuUF53.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-DniPFbo8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-fK6zQvHp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/node/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/node/index.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/md-DjeRApKy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.1

9 findings

HIGH New obfuscated file: dist/node/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/node/index.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/index-COHaJzee.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-D3TL70UM.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-DNwLE6Kk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/node/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/node/index.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/md-Bxvu6Hld.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.5.0