← Home

@hpcc-js/observablehq-compiler

npm Repository Homepage

hpcc-js - ObservableHQ Compiler (unoffical)

25
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

hpcc-js

Keywords

observablehqmarkdownobservablecompilerinterpreterrenderer

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/index-Dg2jQBIA.js AI (source-diff): Minified bundle; standard build artifact. ai
source-diff obfuscated-file:dist/index-DCkNfE2E.js AI (source-diff): Minified bundle; standard build artifact. ai
source-diff obfuscated-file:dist/index-COQTb7t_.js AI (source-diff): Minified Lezer HTML parser bundle; standard build artifact. ai
source-diff obfuscated-file:dist/index-C0WTq6je.js AI (source-diff): Minified Lezer parser runtime bundle; standard build artifact. ai
source-diff obfuscated-file:dist/index-BjI7I3K0.js AI (source-diff): Minified Lezer Python parser bundle; standard build artifact. ai
source-diff obfuscated-file:dist/index-7PV71_ts.js AI (source-diff): Minified Lezer parser bundle; standard build artifact. ai
source-diff obfuscated-file:dist/highlight-CtvrxX31.js AI (source-diff): Minified syntax highlighting bundle (CodeMirror/Lezer); standard build artifact. ai
source-diff obfuscated-file:dist/md-CM5UsfTf.js AI (source-diff): Minified markdown bundle; standard build artifact. ai
source-diff obfuscated-file:dist/index-CYQKv1-1.js AI (source-diff): Minified Markdown/Lezer parser bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/duckdb-ZQnOaRxt.js AI (source-diff): Minified DuckDB-wasm integration bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-BldIoRTz.js AI (source-diff): Minified CSS/Lezer parser bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/highlight-BKaxK3bG.js AI (source-diff): Minified Lezer/CodeMirror highlight bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-COraVSsF.js AI (source-diff): Minified JS/Lezer parser bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/md-DjeRApKy.js AI (source-diff): Minified Markdown bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-fK6zQvHp.js AI (source-diff): Minified bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-DniPFbo8.js AI (source-diff): Minified bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-D5SuUF53.js AI (source-diff): Minified HTML/Lezer parser bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-DdKlQzon.js AI (source-diff): Minified Lezer CSS parser; legitimate build artifact. ai
source-diff obfuscated-file:dist/duckdb-B8Nsdq8W.js AI (source-diff): Standard Vite-bundled minified output of @duckdb/duckdb-wasm; not obfuscation. ai
source-diff obfuscated-file:dist/highlight-CFtcTZHe.js AI (source-diff): Minified Lezer/CodeMirror highlight library; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-B6ZW_ztj.js AI (source-diff): Minified Lezer HTML parser bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-BFKeSKC_.js AI (source-diff): Minified Lezer parser runtime; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-BLCWtR7X.js AI (source-diff): Minified Lezer Python parser; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-DycSYo5y.js AI (source-diff): Minified Lezer JS/TS parser; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-OHOn4Cvw.js AI (source-diff): Minified Lezer Markdown parser; legitimate build artifact. ai
source-diff obfuscated-file:dist/md-DqUzR4VS.js AI (source-diff): Minified markdown bundle; legitimate build artifact. ai
source-diff obfuscated-file:dist/md-DUaFUKbi.js AI (source-diff): Minified bundle of @sindresorhus/slugify and transliterate; region comments confirm legitimate dependency bundling. ai
source-diff obfuscated-file:dist/dist-HSOoLE8A.js AI (source-diff): Minified bundle of @lezer/javascript; region comments and code structure confirm legitimate dependency bundling. ai
source-diff obfuscated-file:dist/dist-DF_mUoJg.js AI (source-diff): Minified bundle of @lezer/html; region comments and code structure confirm legitimate dependency bundling. ai
source-diff obfuscated-file:dist/dist-C66WUAXi.js AI (source-diff): Minified bundle of @lezer/python; region comments and code structure confirm legitimate dependency bundling. ai
source-diff obfuscated-file:dist/dist-C3tBoEnV.js AI (source-diff): Minified bundle of @lezer/css; region comments and code structure confirm legitimate dependency bundling. ai
source-diff obfuscated-file:dist/md-Bxvu6Hld.js AI (source-diff): Minified markdown processing bundle; legitimate build artifact. ai
source-diff net-exec-file:dist/node/index.js AI (source-diff): Same as index.cjs — core compiler functionality, not malware. ai
source-diff net-exec-file:dist/node/index.cjs AI (source-diff): Network+exec pattern is the core compiler functionality: dynamic import() and new Function() for Observable cell compilation. ai
source-diff obfuscated-file:dist/index-COHaJzee.js AI (source-diff): Minified bundled parser (LRParser/CodeMirror); legitimate build artifact. ai
source-diff obfuscated-file:dist/node/index.js AI (source-diff): Standard minified build output; no malicious patterns. ai
source-diff obfuscated-file:dist/node/index.cjs AI (source-diff): Standard minified build output for an ObservableHQ compiler; code is legitimate parser/compiler logic. ai
source-diff obfuscated-file:dist/index-DNwLE6Kk.js AI (source-diff): Minified bundled JS parser; legitimate build artifact. ai
source-diff obfuscated-file:dist/index-D3TL70UM.js AI (source-diff): Minified bundled CSS parser; legitimate build artifact. ai
semgrep semgrep:shady-links-tlds AI (semgrep): URL appears in a test fixture as mock user data, not in runtime code; no C2/exfil risk. ai
dependencies unvetted-dep:@hpcc-js/observable-shim AI (dependencies): Same @hpcc-js org as this package; trusted publisher with clean track record. ai
semgrep semgrep:new-function-constructor AI (semgrep): Core compiler mechanism for evaluating ObservableHQ notebook cells; inherent to this package's purpose across all versions. ai

Versions (showing 25 of 25)

Version Deps Published
3.8.3 2 / 7
3.8.2 2 / 7
3.8.1 2 / 7
3.8.0 2 / 7
3.7.13 2 / 7
3.7.12 2 / 5
3.7.11 2 / 5
3.7.9 2 / 5
3.7.5 2 / 5
3.5.1 2 / 5
3.5.0 2 / 5
3.4.0 2 / 6
3.3.9 1 / 3
3.3.8 1 / 3
3.3.7 1 / 3
3.3.6 1 / 3
3.3.5 1 / 3
3.3.4 1 / 3
3.3.3 1 / 3
3.3.2 1 / 3
3.3.1 1 / 3
3.3.0 1 / 3
3.2.0 1 / 3
3.1.0 1 / 3
1.5.1 3 / 3

v3.7.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.