@journeyapps-labs/reactor-mod-editor
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Monaco editor ships wasm for its language services; expected. | ai | |
| source-diff | obfuscated-file:dist-module/57.bundle.js | AI (source-diff): Bundled monaco CSS worker adapter, standard webpack output. | ai | |
| source-diff | obfuscated-file:dist-module/697.bundle.js | AI (source-diff): Bundled buffer/base64 polyfills with LICENSE.txt, standard webpack output. | ai | |
| source-diff | obfuscated-file:dist-module/699.bundle.js | AI (source-diff): Bundled monaco HTML worker adapter, standard webpack output. | ai | |
| source-diff | obfuscated-file:dist-module/721.bundle.js | AI (source-diff): Bundled JSON tokenizer chunk, standard webpack output. | ai | |
| source-diff | obfuscated-file:dist-module/986.bundle.js | AI (source-diff): Bundled webpack chunk, minified output not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change reflects CI/CD provenance improvement, not compromise. | ai | |
| source-diff | obfuscated-file:dist-module/241.bundle.js | AI (source-diff): Bundled monaco language-worker chunk (webpack), not obfuscation. | ai | |
| source-diff | obfuscated-file:dist-module/278.bundle.js | AI (source-diff): Bundled vscode-languageserver-types chunk, standard webpack output. | ai | |
| source-diff | obfuscated-file:dist-module/352.bundle.js | AI (source-diff): Bundled CSS language service chunk, standard webpack output. | ai | |
| source-diff | obfuscated-file:dist-module/566.bundle.js | AI (source-diff): Monaco worker-factory bundle, standard webpack output. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires on bundled yaml.worker.bundle.js from monaco-yaml; standard webpack bundle artifact, not malicious. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Fires on same bundled yaml.worker.bundle.js; Reflect.get in minified bundles is a common pattern, not obfuscation. | ai | |
| phantom-deps | phantom-dep:lru-cache | AI (phantom-deps): Declared in package.json as a runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:monaco-yaml | AI (phantom-deps): Monaco plugin loaded via config/dynamic registration; not a direct import but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@projectstorm/react-workspaces-core | AI (phantom-deps): UI framework dep used via config; phantom-dep heuristic false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common for this publisher's packages; not a risk signal here. | ai |
v2.3.0
13 findingsPackage contains compiled binaries that could be backdoors: • dist-module/6e3d5ec6699a8d147d29.wasm
This version was published by a different npm account than previous versions on 2026-07-08. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — minified bundler output, not obfuscation on its own.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — minified bundler output, not obfuscation on its own.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — minified bundler output, not obfuscation on its own.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.