← Home

@jait/gateway

Jait AI gateway — local-first AI coding agent with terminal, filesystem, and browser control

100
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

jakobwl

Keywords

aiagentcodinggatewayterminallocal-first

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:web-dist/assets/blockDiagram-WCTKOSBZ-CNLmGpHu.js AI (source-diff): Minified mermaid block diagram bundle; standard build artifact. ai
source-diff obfuscated-file:web-dist/assets/graph-BDokxLqo.js AI (source-diff): Minified graph library bundle; standard build artifact. ai
source-diff net-exec-file:web-dist/assets/index-B3efWHMg.js AI (source-diff): Network+exec pattern is mermaid's dynamic diagram renderer in bundled frontend, not malware. ai
source-diff obfuscated-file:web-dist/assets/index-B3efWHMg.js AI (source-diff): Standard Vite-bundled frontend output; minified open-source libs (mermaid, d3, etc.). ai
source-diff obfuscated-file:web-dist/assets/architectureDiagram-2XIMDMQ5-Dc-KsYhx.js AI (source-diff): Minified mermaid architecture diagram renderer; standard build output. ai
source-diff obfuscated-file:web-dist/assets/cose-bilkent-S5V4N54A-DKSvV8VX.js AI (source-diff): Minified cose-bilkent cytoscape layout library; standard build output. ai
source-diff obfuscated-file:web-dist/assets/dagre-KLK3FWXG-DJ0xtDkx.js AI (source-diff): Minified dagre graph layout library; standard build output. ai
source-diff large-new-source-files AI (source-diff): Large file count reflects first inclusion of bundled web-dist frontend assets. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IP is 127.0.0.1 (localhost) health check — not an external exfiltration endpoint. ai
phantom-deps phantom-dep:zod AI (phantom-deps): zod is a declared runtime dep used in config/schema files; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:pino AI (phantom-deps): pino is a declared runtime dep; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:@fastify/websocket AI (phantom-deps): @fastify/websocket is a declared runtime dep; phantom-dep heuristic false positive. ai
semgrep semgrep:dll-hijacking-commands AI (semgrep): Fires on frozen JSON grammar definition blob in bundled web asset; no actual DLL loading commands present. ai
semgrep semgrep:env-spread AI (semgrep): env spread is used to pass current env plus a flag to a background child process — standard daemon-launch pattern, not exfiltration. ai

Versions (showing 100 of 243)

Version Deps Published
0.1.481 22 / 5
0.1.474 19 / 4
0.1.472 19 / 4
0.1.469 19 / 4
0.1.468 19 / 4
0.1.467 19 / 4
0.1.466 19 / 4
0.1.460 19 / 4
0.1.459 19 / 4
0.1.449 19 / 4
0.1.448 19 / 4
0.1.447 19 / 4
0.1.446 19 / 4
0.1.445 19 / 4
0.1.444 19 / 4
0.1.443 19 / 4
0.1.442 19 / 4
0.1.441 19 / 4
0.1.440 19 / 4
0.1.439 19 / 4
0.1.438 19 / 4
0.1.437 19 / 4
0.1.436 19 / 4
0.1.435 19 / 4
0.1.434 19 / 4
0.1.433 19 / 4
0.1.431 19 / 4
0.1.430 19 / 4
0.1.429 19 / 4
0.1.428 19 / 4
0.1.427 19 / 4
0.1.426 19 / 4
0.1.425 19 / 4
0.1.424 19 / 4
0.1.423 19 / 4
0.1.422 19 / 4
0.1.421 19 / 4
0.1.420 19 / 4
0.1.419 19 / 4
0.1.417 19 / 4
0.1.415 19 / 4
0.1.414 19 / 4
0.1.412 17 / 4
0.1.411 17 / 4
0.1.410 17 / 4
0.1.407 17 / 4
0.1.406 17 / 4
0.1.405 17 / 4
0.1.404 17 / 4
0.1.403 17 / 4
0.1.402 17 / 4
0.1.401 17 / 4
0.1.400 17 / 4
0.1.399 17 / 4
0.1.398 17 / 4
0.1.395 17 / 4
0.1.394 17 / 4
0.1.393 17 / 4
0.1.391 17 / 4
0.1.390 17 / 4
0.1.389 17 / 4
0.1.388 17 / 4
0.1.387 17 / 4
0.1.386 17 / 4
0.1.385 17 / 4
0.1.384 17 / 4
0.1.383 17 / 4
0.1.382 17 / 4
0.1.381 17 / 4
0.1.380 17 / 4
0.1.379 17 / 4
0.1.378 17 / 4
0.1.377 17 / 4
0.1.376 17 / 4
0.1.375 17 / 4
0.1.374 17 / 4
0.1.373 17 / 4
0.1.372 17 / 4
0.1.371 17 / 4
0.1.370 17 / 4
0.1.369 17 / 4
0.1.368 17 / 4
0.1.367 17 / 4
0.1.366 17 / 4
0.1.365 17 / 4
0.1.364 17 / 4
0.1.363 17 / 4
0.1.362 17 / 4
0.1.361 17 / 4
0.1.360 17 / 4
0.1.359 17 / 4
0.1.358 17 / 4
0.1.357 17 / 4
0.1.356 17 / 4
0.1.355 17 / 4
0.1.354 17 / 4
0.1.353 17 / 4
0.1.352 17 / 4
0.1.351 17 / 4
0.1.350 17 / 4
Showing 100 of 243 Next page →

v0.1.481

28 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-Bic_0Ku1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-CEc8Gtj6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-BU1Io8ja.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-sCUOeM9Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-kYgaGoR6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-BrtHBM6x.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-BzrpmYZL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-BlNFSjWJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-Dqsr0-8e.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-BqgEtSgl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-DQKdSExU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-Dfb4F2Jr.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-C9pvM7B0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-DF1ng26T.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-B0qCsau1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-bPwc_s9j.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-DFyEPY0C.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-DFyEPY0C.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-BSD3bhDW.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-C1XiiAHp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-Bnl3u8lM.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-DuulVMp8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-BdWH0fqS.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-CP7IM4ly.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-Ci0HHhZZ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-Cpa6xzfS.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sankeyDiagram-WA2Y5GQK-YC0w4y3m.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.474

26 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-CyOHAlPu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-BosaDeCC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-CDjSKL2t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CuN0iPuy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-B1WYXpQz.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-DjTk3V59.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-BFZwy12F.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-BE8d4TaU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-CGQVd8wn.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-L-bhKQH2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-CudvsRLB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-CNFNrFlw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-BPpvFBRD.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-D51EpcKv.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-C6fQm51l.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-LYh9mLWJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-LYh9mLWJ.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-o2qiApBb.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-CCYP3k_4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-urGad2FU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-MvxJzrhU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-C7ZrXsKR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-DKBHuWox.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-Dv6RdchU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-BnmbrzbB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.472

26 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-CZiacepn.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-DGbJAqoN.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-DeurLCSO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-Do_eYvv6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-CoeJ8t1f.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-Cybl7_7S.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-DUUc59A3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-DeqG8be1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-DkfGN0vP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-CMXtxWUN.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-C7w5NSjx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-BY7ORpwh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-CKBTYagf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-DL5Ta5YV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-DY-bJILm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-CJcdsvDp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-CRLdm-EG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-CRLdm-EG.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-NOsFfrFI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-ClIzAE7a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-DClYlWEV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-BeZbz0rT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-BsU_KAFM.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-bdz9qpw4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-D2gNfNmj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.469

27 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-CGdYgIQO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-BIiiljxm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-Dc-KsYhx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CNLmGpHu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-CXKq0CVu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-DKSvV8VX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-DJ0xtDkx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-r_IEDKQ9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-CyS5UhUQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-BiQ6jHRI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-C2KKSzxR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-Bk5o3xwY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-R-g1HZeJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-CNR1T2A0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-BDokxLqo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-B3efWHMg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-B3efWHMg.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-X_HqYFSK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-DaL-6kNl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-CrUqM7ha.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-x6NQalgL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-DR3Bn2wy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-DR-C_7zC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-Ds-dTXzu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-tSU0sVI6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-CfPYNDIb.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.468

27 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-CGdYgIQO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-BIiiljxm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-Dc-KsYhx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CNLmGpHu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-CXKq0CVu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-DKSvV8VX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-DJ0xtDkx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-r_IEDKQ9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-CyS5UhUQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-BiQ6jHRI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-C2KKSzxR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-Bk5o3xwY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-R-g1HZeJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-CNR1T2A0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-BDokxLqo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-B3efWHMg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-B3efWHMg.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-X_HqYFSK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-DaL-6kNl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-CrUqM7ha.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-x6NQalgL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-DR3Bn2wy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-DR-C_7zC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-Ds-dTXzu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-tSU0sVI6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-CfPYNDIb.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.467

27 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-CGdYgIQO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-BIiiljxm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-Dc-KsYhx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CNLmGpHu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-CXKq0CVu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-DKSvV8VX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-DJ0xtDkx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-r_IEDKQ9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-CyS5UhUQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-BiQ6jHRI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-C2KKSzxR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-Bk5o3xwY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-R-g1HZeJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-CNR1T2A0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-BDokxLqo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-B3efWHMg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-B3efWHMg.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-X_HqYFSK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-DaL-6kNl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-CrUqM7ha.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-x6NQalgL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-DR3Bn2wy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-DR-C_7zC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-Ds-dTXzu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-tSU0sVI6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-CfPYNDIb.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.466

27 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-CGdYgIQO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-BIiiljxm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-Dc-KsYhx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CNLmGpHu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-CXKq0CVu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-DKSvV8VX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-DJ0xtDkx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-r_IEDKQ9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-CyS5UhUQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-BiQ6jHRI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-C2KKSzxR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-Bk5o3xwY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-R-g1HZeJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-CNR1T2A0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-BDokxLqo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-B3efWHMg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-B3efWHMg.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-X_HqYFSK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-DaL-6kNl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-CrUqM7ha.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-x6NQalgL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-DR3Bn2wy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-DR-C_7zC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-Ds-dTXzu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-tSU0sVI6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-CfPYNDIb.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.460

34 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-BzmTBuCK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-D_str31s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-iGpZ5eMv.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CzaQqynl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-PyiTG4vY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-BxdF5cV-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-Dm4scFIL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-Bne6RKl6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-j2mQ5C5l.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-CdzuLWEw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-DZrdptsJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-DgjJzAMy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-BUK9KV20.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-D30kLUud.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-Uq5Ey2rZ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-CPsRY9iy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-CPsRY9iy.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-Dl_78WX8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-CoNyYrRv.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-DhNuQwoO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-CiBoEtT_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-CclAjc31.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-D0T2Ue4i.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-Bs5KOLlF.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-CTrNOfNq.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-Lfkxswx5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sankeyDiagram-WA2Y5GQK-D7VXd1gH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sequenceDiagram-2WXFIKYE-BobMUXZE.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/stateDiagram-RAJIS63D-BiTIuwsM.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/timeline-definition-YZTLITO2-rKlur9hp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/treemap-KZPCXAKY-BtERtPNk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/vennDiagram-LZ73GAT5-Ke0QhSrP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/xychartDiagram-JWTSCODW-Cl96gv3X.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.459

34 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-D1rP23sP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-BZez8uiI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-CBjNSVej.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-ClFIF-by.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-B8JTgVuV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-DDa2siwF.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-gnz4jOj6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-kWsk0Ayk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-CKFQ4UWV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-D7CxGbaA.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-Clybs-qO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-BnWQ9gCB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-Br3O9nof.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-CM6UB5ii.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-CCyB7p3W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-Cq4e58jx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-Cq4e58jx.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/index-iRclKKEy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-GhjswR6l.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-BcfF4Tyu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-CVjQL1oG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-nzu8URXl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-CEQeN8T6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-DavN8Cni.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-T_4jQdt2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-CsCgI7ol.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sankeyDiagram-WA2Y5GQK-ZH6v4ph0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sequenceDiagram-2WXFIKYE-B5BPH36S.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/stateDiagram-RAJIS63D-CeIeiINI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/timeline-definition-YZTLITO2-D0G_gQHX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/treemap-KZPCXAKY-BEI9z1k3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/vennDiagram-LZ73GAT5-d78BzcJw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/xychartDiagram-JWTSCODW-DkGXRlS1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.449

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/78a1ad8024fe13fcb1cc81425adeb9ef8afc10c0/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/78a1ad8024fe13fcb1cc81425adeb9ef8afc10c0/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/78a1ad8024fe13fcb1cc81425adeb9ef8afc10c0/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/78a1ad8024fe13fcb1cc81425adeb9ef8afc10c0/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.448

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/c9f9ef746fa8b56c712ba1a3b7764835560480b5/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c9f9ef746fa8b56c712ba1a3b7764835560480b5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c9f9ef746fa8b56c712ba1a3b7764835560480b5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c9f9ef746fa8b56c712ba1a3b7764835560480b5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.447

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/4401a1249bb301b0630a37f0f6aa9a4e41934b1b/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/4401a1249bb301b0630a37f0f6aa9a4e41934b1b/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/4401a1249bb301b0630a37f0f6aa9a4e41934b1b/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/4401a1249bb301b0630a37f0f6aa9a4e41934b1b/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.446

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/d4862182ea2a8f062fe26c72669302fae1a1da8d/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/d4862182ea2a8f062fe26c72669302fae1a1da8d/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/d4862182ea2a8f062fe26c72669302fae1a1da8d/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/d4862182ea2a8f062fe26c72669302fae1a1da8d/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.445

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/270d7b91533cd04a25dd273a10267c977dfbf487/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/270d7b91533cd04a25dd273a10267c977dfbf487/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/270d7b91533cd04a25dd273a10267c977dfbf487/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/270d7b91533cd04a25dd273a10267c977dfbf487/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.444

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/5d16eb1779d39d384473493e0e926f510ce1476c/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/5d16eb1779d39d384473493e0e926f510ce1476c/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/5d16eb1779d39d384473493e0e926f510ce1476c/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/5d16eb1779d39d384473493e0e926f510ce1476c/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.443

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/7866221dec5dd9679c4316d660d99cd04044f8cc/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/7866221dec5dd9679c4316d660d99cd04044f8cc/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/7866221dec5dd9679c4316d660d99cd04044f8cc/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/7866221dec5dd9679c4316d660d99cd04044f8cc/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.442

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/5d243e3e953f0d2f352c77308107d35cea95c4ac/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/5d243e3e953f0d2f352c77308107d35cea95c4ac/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/5d243e3e953f0d2f352c77308107d35cea95c4ac/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/5d243e3e953f0d2f352c77308107d35cea95c4ac/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.441

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/c5ac368d8ca3c11dc855d8f3500d720b6f3fb7e5/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c5ac368d8ca3c11dc855d8f3500d720b6f3fb7e5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c5ac368d8ca3c11dc855d8f3500d720b6f3fb7e5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c5ac368d8ca3c11dc855d8f3500d720b6f3fb7e5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.440

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/e8ca069b45f64f0f1bbb5a10b423c543fa4f8b73/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/e8ca069b45f64f0f1bbb5a10b423c543fa4f8b73/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/e8ca069b45f64f0f1bbb5a10b423c543fa4f8b73/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/e8ca069b45f64f0f1bbb5a10b423c543fa4f8b73/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.439

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/036ddba097a2de28dc382d7a6a2411a3f6a68c43/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/036ddba097a2de28dc382d7a6a2411a3f6a68c43/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/036ddba097a2de28dc382d7a6a2411a3f6a68c43/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/036ddba097a2de28dc382d7a6a2411a3f6a68c43/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.438

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/857e0aef8b23e3e432b291c961beae0a6eb5c935/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/857e0aef8b23e3e432b291c961beae0a6eb5c935/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/857e0aef8b23e3e432b291c961beae0a6eb5c935/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/857e0aef8b23e3e432b291c961beae0a6eb5c935/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.437

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/100a2a4fc336cdcc85dafd615a91d702c36c922b/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/100a2a4fc336cdcc85dafd615a91d702c36c922b/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/100a2a4fc336cdcc85dafd615a91d702c36c922b/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/100a2a4fc336cdcc85dafd615a91d702c36c922b/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.436

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/f5c0865c925f9899886b4f69e2d1f8d188860e50/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/f5c0865c925f9899886b4f69e2d1f8d188860e50/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/f5c0865c925f9899886b4f69e2d1f8d188860e50/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/f5c0865c925f9899886b4f69e2d1f8d188860e50/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.435

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/cc0a23e1bff0523932e810f923c1cf2c3068f3cb/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/cc0a23e1bff0523932e810f923c1cf2c3068f3cb/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/cc0a23e1bff0523932e810f923c1cf2c3068f3cb/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/cc0a23e1bff0523932e810f923c1cf2c3068f3cb/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.434

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/e42d734d32ec32b50ed533dd891748ba117c688f/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/e42d734d32ec32b50ed533dd891748ba117c688f/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/e42d734d32ec32b50ed533dd891748ba117c688f/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/e42d734d32ec32b50ed533dd891748ba117c688f/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.433

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/88c9ac15a6bcbc234b4f91594f8f62760629d99c/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/88c9ac15a6bcbc234b4f91594f8f62760629d99c/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/88c9ac15a6bcbc234b4f91594f8f62760629d99c/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/88c9ac15a6bcbc234b4f91594f8f62760629d99c/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.431

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/ab45dcfcabbff6a292f82ac02f092cfd6efaeec2/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/ab45dcfcabbff6a292f82ac02f092cfd6efaeec2/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/ab45dcfcabbff6a292f82ac02f092cfd6efaeec2/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/ab45dcfcabbff6a292f82ac02f092cfd6efaeec2/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.430

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/1239726778407f66e98ea465cb8dfa7816009c77/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1239726778407f66e98ea465cb8dfa7816009c77/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1239726778407f66e98ea465cb8dfa7816009c77/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1239726778407f66e98ea465cb8dfa7816009c77/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.429

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/c0ff8bffd0e01f7ad08e063355f5d1ee5dccb034/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c0ff8bffd0e01f7ad08e063355f5d1ee5dccb034/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c0ff8bffd0e01f7ad08e063355f5d1ee5dccb034/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/c0ff8bffd0e01f7ad08e063355f5d1ee5dccb034/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.428

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/17442255b40e8cef1f4c54b1a5ea66f94a85737a/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/17442255b40e8cef1f4c54b1a5ea66f94a85737a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/17442255b40e8cef1f4c54b1a5ea66f94a85737a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/17442255b40e8cef1f4c54b1a5ea66f94a85737a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.427

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/7c5c865c384712da1126f2d2843e680fb9d0fe59/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/7c5c865c384712da1126f2d2843e680fb9d0fe59/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/7c5c865c384712da1126f2d2843e680fb9d0fe59/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/7c5c865c384712da1126f2d2843e680fb9d0fe59/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.426

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/94eb2126442ba4811c04d041544c0e628d594d10/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/94eb2126442ba4811c04d041544c0e628d594d10/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/94eb2126442ba4811c04d041544c0e628d594d10/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/94eb2126442ba4811c04d041544c0e628d594d10/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.425

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/416487d7b069a828d6bd9b03f54e704309bc44ef/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/416487d7b069a828d6bd9b03f54e704309bc44ef/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/416487d7b069a828d6bd9b03f54e704309bc44ef/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/416487d7b069a828d6bd9b03f54e704309bc44ef/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.424

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/014a48685b2b62f99744a3adc789e5d79376f3f4/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/014a48685b2b62f99744a3adc789e5d79376f3f4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/014a48685b2b62f99744a3adc789e5d79376f3f4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/014a48685b2b62f99744a3adc789e5d79376f3f4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.423

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/3846f1cb5e76ac94f62f1188db63d76f73ef5ed4/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/3846f1cb5e76ac94f62f1188db63d76f73ef5ed4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/3846f1cb5e76ac94f62f1188db63d76f73ef5ed4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/3846f1cb5e76ac94f62f1188db63d76f73ef5ed4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.422

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/62d426f88fd8a24d3c9efb30d3307d863b4c4579/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/62d426f88fd8a24d3c9efb30d3307d863b4c4579/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/62d426f88fd8a24d3c9efb30d3307d863b4c4579/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/62d426f88fd8a24d3c9efb30d3307d863b4c4579/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.421

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/a50b9a6a8932aa4091bd97d0f81601eda8d33c04/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/a50b9a6a8932aa4091bd97d0f81601eda8d33c04/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/a50b9a6a8932aa4091bd97d0f81601eda8d33c04/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/a50b9a6a8932aa4091bd97d0f81601eda8d33c04/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.420

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/1d3c5ffc7736d0afeb167563b3f66892a6003e60/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1d3c5ffc7736d0afeb167563b3f66892a6003e60/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1d3c5ffc7736d0afeb167563b3f66892a6003e60/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1d3c5ffc7736d0afeb167563b3f66892a6003e60/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.419

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/1600959faa86f66bb6ca4feb4599319f3243592a/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1600959faa86f66bb6ca4feb4599319f3243592a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1600959faa86f66bb6ca4feb4599319f3243592a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/1600959faa86f66bb6ca4feb4599319f3243592a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.417

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/95d79e75801d9e4960704a9b344cb7badb927c6a/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/95d79e75801d9e4960704a9b344cb7badb927c6a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/95d79e75801d9e4960704a9b344cb7badb927c6a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/95d79e75801d9e4960704a9b344cb7badb927c6a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.415

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/9153436cc03b71582c8a0b60a703b2c3452e3483/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/9153436cc03b71582c8a0b60a703b2c3452e3483/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/9153436cc03b71582c8a0b60a703b2c3452e3483/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/9153436cc03b71582c8a0b60a703b2c3452e3483/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.414

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/72b835c0c553597bd29aa2c58dfbaeb96fa31a48/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/72b835c0c553597bd29aa2c58dfbaeb96fa31a48/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/72b835c0c553597bd29aa2c58dfbaeb96fa31a48/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/72b835c0c553597bd29aa2c58dfbaeb96fa31a48/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.412

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/941e93b16e87a3bea289b13677b45b19de65636a/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/941e93b16e87a3bea289b13677b45b19de65636a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/941e93b16e87a3bea289b13677b45b19de65636a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/941e93b16e87a3bea289b13677b45b19de65636a/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.411

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/6e68f0ce7afa9823aac0d00fc9e3ea3a48bbc4b0/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/6e68f0ce7afa9823aac0d00fc9e3ea3a48bbc4b0/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/6e68f0ce7afa9823aac0d00fc9e3ea3a48bbc4b0/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/6e68f0ce7afa9823aac0d00fc9e3ea3a48bbc4b0/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.410

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/86955b43e1cca4d68c20ef7946c65ca73e36e1af/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/86955b43e1cca4d68c20ef7946c65ca73e36e1af/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/86955b43e1cca4d68c20ef7946c65ca73e36e1af/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/86955b43e1cca4d68c20ef7946c65ca73e36e1af/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.407

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/33c64621d4ca7773ddc8e1e59e3d651f76b600a4/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/33c64621d4ca7773ddc8e1e59e3d651f76b600a4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/33c64621d4ca7773ddc8e1e59e3d651f76b600a4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/33c64621d4ca7773ddc8e1e59e3d651f76b600a4/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.406

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/de88e6de2d499ffb6aff773079754f651fbf7a28/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/de88e6de2d499ffb6aff773079754f651fbf7a28/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/de88e6de2d499ffb6aff773079754f651fbf7a28/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/de88e6de2d499ffb6aff773079754f651fbf7a28/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.405

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/00c3e30dacb437986757cab11d068b10d139e599/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/00c3e30dacb437986757cab11d068b10d139e599/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/00c3e30dacb437986757cab11d068b10d139e599/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/00c3e30dacb437986757cab11d068b10d139e599/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.404

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/08349e349c509c8d418c5caf0c14d647d6caf5c7/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/08349e349c509c8d418c5caf0c14d647d6caf5c7/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/08349e349c509c8d418c5caf0c14d647d6caf5c7/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/08349e349c509c8d418c5caf0c14d647d6caf5c7/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.403

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/daad99b5eba612ea4ba0c65379ca1dec557383bb/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/daad99b5eba612ea4ba0c65379ca1dec557383bb/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/daad99b5eba612ea4ba0c65379ca1dec557383bb/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/daad99b5eba612ea4ba0c65379ca1dec557383bb/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.402

34 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-C29ZGEj4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-i0FlbMD5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-DPyr9jtt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-CXFQaxle.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-Do_Z7oy0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-PIq9GA_z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-CdBUYO5m.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-BO8oSjk1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-C2ncQSCW.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-Coqal_sp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-CjDNUYfv.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-D8XxQE92.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-BIiwpSX7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-DbzlY20l.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-BtgtY1ao.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-6CZK0zgk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-Dy0PkHlz.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-Dy0PkHlz.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-BHc8OreU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-CiBVxxlY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-C1rgcn_F.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-CdKg_Rwl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-Xiu1sDLO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-D8tU-mIN.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-CAbfknvr.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-B8MganhZ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sankeyDiagram-WA2Y5GQK-DalR8qS4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sequenceDiagram-2WXFIKYE-C8vLzNPh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/stateDiagram-RAJIS63D-CiiDRSPH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/timeline-definition-YZTLITO2-dy3ZTjT7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/treemap-KZPCXAKY-DVzH0TpM.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/vennDiagram-LZ73GAT5-BWieJ8xA.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/xychartDiagram-JWTSCODW-BsyQrQwu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.401

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/133a45c0112a87d3f238e3a3f74ea777d586d4f5/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/133a45c0112a87d3f238e3a3f74ea777d586d4f5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/133a45c0112a87d3f238e3a3f74ea777d586d4f5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/133a45c0112a87d3f238e3a3f74ea777d586d4f5/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.400

34 findings
HIGH New obfuscated file: web-dist/assets/_baseUniq-DRNViPzT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/arc-oH7W2OOY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/architectureDiagram-2XIMDMQ5-DapOVuX3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/blockDiagram-WCTKOSBZ-bpS4zrED.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/c4Diagram-IC4MRINW-DM-pkJc3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/cose-bilkent-S5V4N54A-sW7S9Ae1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/dagre-KLK3FWXG-kxJwoHgV.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-E7M64L7V-Bg5Eyy-2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-IFDJBPK2-BYmorqt2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/diagram-P4PSJMXO-Cb5l3F9n.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/erDiagram-INFDFZHY-DN9x0OIG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/flowDiagram-PKNHOUZH-Djz3QLsP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/ganttDiagram-A5KZAMGK-BqVkc3Jh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/gitGraphDiagram-K3NZZRJ6-BL8deiY_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/graph-DWhpX3Ix.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-BsoTdRqT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/index-C7kKgGnY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: web-dist/assets/index-C7kKgGnY.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: web-dist/assets/ishikawaDiagram-PHBUUO56-DsQLKlWr.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/journeyDiagram-4ABVD52K-BgGZnvld.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/kanban-definition-K7BYSVSG-xE6Y25oR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/layout-BNLMqqC5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/linear-COctYtWz.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/mindmap-definition-YRQLILUH-DLYRjwwQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/quadrantDiagram-337W2JSQ-DSMmBnJ4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/requirementDiagram-Z7DCOOCP-BsKijyn4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sankeyDiagram-WA2Y5GQK-7EoC-mbj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/sequenceDiagram-2WXFIKYE-Dtw84ddC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/stateDiagram-RAJIS63D-Cy3By3XP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/timeline-definition-YZTLITO2-Cnnqb-C3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/treemap-KZPCXAKY-B3JLLTCw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/vennDiagram-LZ73GAT5-C-h8I7kl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: web-dist/assets/xychartDiagram-JWTSCODW-CoY86USH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.399

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/32bbd6670d8e564c0e521b3a7985783d1cfc0399/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/32bbd6670d8e564c0e521b3a7985783d1cfc0399/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/32bbd6670d8e564c0e521b3a7985783d1cfc0399/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/32bbd6670d8e564c0e521b3a7985783d1cfc0399/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.398

5 findings
HIGH env-spread: bin/jait.mjs:343 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/90af4d8b3f25de5733f4540720d4101cdfae7b2f/bin/jait.mjs#L343 341 | detached: true, 342 | stdio: ["ignore", logFd, errFd], > 343 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 344 | windowsHide: true, 345 | });

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/90af4d8b3f25de5733f4540720d4101cdfae7b2f/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/90af4d8b3f25de5733f4540720d4101cdfae7b2f/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

HIGH dll-hijacking-commands: web-dist/assets/bat-BkioyH1T.js:1 semgrep

DLL side-loading command detected — potential DLL hijacking Source: https://github.com/Widev-e-U/Jait/blob/90af4d8b3f25de5733f4540720d4101cdfae7b2f/web-dist/assets/bat-BkioyH1T.js#L1 > 1 | const e=Object.freeze(JSON.parse('{"displayName":"Batch File","injections":{"L:meta.block.repeat.batchfile":{"patterns":

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.395

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/09b621acf7233a71bcfb20bb6ae5a0131a5e6bbc/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.394

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/0ff6694d6f1613a15b6b51c2f977287441d7218d/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.393

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/365697c06f9ebfaca7041665ac50ec5efa13a8e4/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.391

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/b6eb96abaa5f845a8ba3acab54ad94f495aa7d21/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.390

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/40896115d7c282f2db6af39a8f70059cb5e2ad6e/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.389

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/74ccd806022f80361163685eefa4eb5f2cb03888/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.388

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/eabfd504cf2564a2c41b515b88249f5eedcbc9b5/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.387

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/3cff6ce5dca5b3db7d07f705cc88bedb62209629/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.386

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/543b93b5602a588f763e3005572eb803edf15745/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.385

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/7d0f334101f0a073e38d19605a23afeb3303e4fd/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.384

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/56b1277916e20fbc8c6eba99e3459cff21f31539/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.383

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/9deee3f54ce49f55b1beb3fe4973aaa8e7e71080/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.382

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/fbd633675d7cdb21dfda7d27326f26632f52b353/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.381

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/65522686f5072b989f0aba26987c7c69b2ffd847/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.380

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/cf10122e3e3f20245ff5776aa04f0736260f64ff/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.379

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/b37b2adf140d1dc27e29cbd1589483c4ac0f9feb/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.378

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/5a32acbbe3e72cb734a2a90fc7ad2ff4102f4103/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.377

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/066d394d956f49d5240aadf7cd58fd0faee43eab/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.376

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/b17922e5a663d9f45020bc928b4fd62bc1c55d3c/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.375

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/cbe7ea18a05b640f71c2409aee74fadf3d7f098c/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.374

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/2b8a72f85f6a52b96020f4a81cf826a29b2908a2/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.373

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/ecd671f3851cb5ea6e2d862a1119268a0a361113/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.372

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/5f0dd37bc16eee229663b80df04d5ea9152540be/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.371

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/a0da5d1af258209405d9a3107a338eeaabef5df5/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.370

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/91c3ed3feaad259195b5d1d75371696409201ff9/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.369

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/a3acaa793b71415087df32be336ea07facde6cd3/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.368

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/c2282e62af20f6b361b64d9db68572da51871d38/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.367

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/4f03873a3ce9151760936f1087df5e1b6b2094ab/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.366

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/82b1326e92a1e675c21a67392c8b11c147ff5790/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.365

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/175475da5939444dbfd4b2583a80831bc58027ac/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.364

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/5186b10593a5e15ec90235ce4fcfa58b48dca21b/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.363

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/04471c13d0905978e860afa011480f2aada91a78/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.362

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/9b2f2741cd21f23b570a93b73bd94feeefbf8934/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.361

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/607cd239272a2b16efb631ea5226f3f91a9f7126/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.360

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/d1bdbe8290b62e933c32526f422806e52700a911/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.359

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/37150d916622b95bc3f9fa4a7cc7e79955f037b5/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.358

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/4de8fbf5eb5af2159f5b92ae9d170a103841d5f8/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.357

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/ae78b409b81f2f74afaafd42a4bfcef91b010468/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.356

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/89641b59379b46ddc1912fd580b2c65e7587fd64/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.355

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/b2d375b1f056483c57993960f368016d2b36035b/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.354

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/99b345085166471e1c35f0bded3b6c68a3057271/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.353

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/154514e1cc502ab4195529048e2e44d214a94727/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.352

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/c21cdc85e1f1ebd518f953c896da86f747f9be5b/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.351

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/df9e6769a0577151cca559f0a519ed537910bf85/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.350

2 findings
HIGH env-spread: bin/jait.mjs:269 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Widev-e-U/Jait/blob/399cecbcc8d929d33bf33c8709cf6d96de9b2ea7/bin/jait.mjs#L269 267 | detached: true, 268 | stdio: ["ignore", logFd, errFd], > 269 | env: { ...process.env, __JAIT_BACKGROUND: "1" }, 270 | windowsHide: true, 271 | });

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.