@imgly/plugin-ai-image-generation-web
AI image generation plugin for the CE.SDK editor
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): New publisher mirko314-imgly is part of the same @imgly org with 47 approved packages; routine maintainer transition. | ai | |
| source-diff | net-exec-file:dist/bytedance/index.mjs | AI (source-diff): Network calls are expected for an AI image generation provider plugin; no dynamic code execution pattern visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bytedance/index.mjs | AI (source-diff): Minified provider bundle matching existing pattern (fal-ai, open-ai, etc.); code is readable asset-search logic, not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/eachlabs/index.mjs | AI (source-diff): Network calls are to the eachlabs AI API (expected for an AI image generation plugin); code execution is standard JS function calls, not eval/dynamic execution. False positive for this package. | ai | |
| source-diff | obfuscated-file:dist/eachlabs/index.mjs | AI (source-diff): IMG.LY ships minified/bundled dist files for all their CE.SDK plugins. The sample shows legitimate UI plugin code (panel registration, image selection, i18n), not obfuscation. | ai | |
| dependencies | unvetted-dep:@imgly/plugin-ai-generation-web | AI (dependencies): Same-org sibling package from IMG.LY GmbH, versioned in lockstep with this package. Normal monorepo dependency pattern; not a third-party risk. | ai | |
| provenance | no-provenance | AI (provenance): IMG.LY packages consistently lack Sigstore provenance; this is a stable characteristic of the publisher, not a per-version anomaly. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 1.78.0 | 1 / 13 | |
| 1.77.1 | 1 / 13 | |
| 1.77.0 | 1 / 13 | |
| 1.76.1 | 1 / 11 | |
| 1.76.0 | 1 / 11 | |
| 1.75.1 | 1 / 11 | |
| 1.75.0 | 1 / 11 | |
| 1.74.2 | 1 / 11 | |
| 1.74.1 | 1 / 11 | |
| 1.74.0 | 1 / 11 | |
| 1.73.1 | 1 / 11 | |
| 1.73.0 | 1 / 11 | |
| 1.72.3 | 1 / 11 | |
| 1.72.2 | 1 / 11 | |
| 1.72.1 | 1 / 11 | |
| 1.72.0 | 1 / 11 | |
| 1.71.0 | 1 / 11 | |
| 1.70.1 | 1 / 11 | |
| 1.70.0 | 1 / 11 | |
| 1.69.0 | 1 / 11 | |
| 1.68.0 | 1 / 11 | |
| 0.2.17 | 1 / 11 | |
| 0.2.16 | 1 / 11 | |
| 0.2.15 | 1 / 11 | |
| 0.2.14 | 1 / 11 | |
| 0.2.12 | 0 / 12 | |
| 0.2.11 | 1 / 11 |
v1.78.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.77.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.77.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.