@jspm/core
This package contains the core libraries used in jspm 2.
10
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jkrishnabubblyworldguybedford
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding in nodelibs/crypto.js is standard AES cipher implementation (parsing ciphertext from base64) in the crypto-browserify shim — not malicious payload hiding. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding in nodelibs/crypto.js is standard AES cipher implementation (parsing IV from hex) in the crypto-browserify shim — not malicious payload hiding. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @jspm/core is a legitimate scoped package under the @jspm org; name similarity to 'cors' is purely coincidental and not a typosquat. | ai | |
| source-diff | encoded-string-file:nodelibs/crypto.js | AI (source-diff): @jspm/core ships minified/bundled ESM polyfills built via jspm build; long strings in nodelibs/*.js are minified bundle artifacts, not obfuscated payloads. Stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established JSPM core polyfill package; no deps by design (all bundled), no repo URL in package.json is a known gap but package has 37 versions and a trusted maintainer. | ai | |
| source-diff | net-exec-file:nodelibs/browser/assert.js | AI (source-diff): Browser polyfill bundles legitimately contain both network APIs and dynamic code execution patterns (vm/eval polyfills); not malware indicators for this package. | ai | |
| source-diff | obfuscated-file:nodelibs/browser/assert.js | AI (source-diff): Files in nodelibs/browser/ are rollup-bundled polyfills for Node.js built-ins; minified output is expected and intentional for this package. | ai | |
| source-diff | net-exec-file:nodelibs/browser/chunk-CjPlbOtt.js | AI (source-diff): Browser polyfill chunk (Object.assign shim). Network+exec pattern is a false positive for bundled browser shims in this package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): vm-browserify uses eval() by design to implement Node's vm.Script.runInThisContext(). This is the expected behavior of a vm module shim. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): timers-browserify shim uses new Function() to replicate Node's setTimeout string-callback behavior. Legitimate and documented upstream. | ai | |
| source-diff | encoded-string-file:nodelibs/browser/crypto.js | AI (source-diff): crypto.js is a bundled crypto-browserify output; long encoded strings are crypto constants. vm-browserify's iframe+eval is documented behavior for the vm shim. | ai | |
| source-diff | net-exec-file:nodelibs/browser/chunk-DtcTpLWz.js | AI (source-diff): Browser polyfill chunk (hasSymbols detection). Network+exec pattern is a false positive for bundled browser shims in this package. | ai |