@kb-labs/qa-entry
CLI commands for KB Labs QA Plugin — qa:run, qa:save, qa:history, qa:trends, qa:regressions, baseline:update, baseline:status.
51
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
k.baranov
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/widgets/46.js | AI (source-diff): Network/exec pattern fires on bundled antd+react code; no hostile destination or dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/widgets/62.js | AI (source-diff): Rspack bundle chunk containing AntV charting + gl-matrix; minified build output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/widgets/62.js | AI (source-diff): Network/exec pattern fires on bundled charting library code; no hostile destination or dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/widgets/648.js | AI (source-diff): Rspack bundle chunk containing dayjs; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/widgets/823.js | AI (source-diff): Rspack bundle chunk containing zod+react/jsx-runtime; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/widgets/78.js | AI (source-diff): Rspack bundle chunk containing react-query; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/widgets/215.js | AI (source-diff): Rspack bundle chunk containing cookie/header parsing code; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/widgets/46.js | AI (source-diff): Rspack bundle chunk containing antd component library; minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/widgets/330.js | AI (source-diff): Minified charting/utility library bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/widgets/884.js | AI (source-diff): Standard rspack widget chunk; minified library code. | ai | |
| source-diff | net-exec-file:dist/widgets/330.js | AI (source-diff): Network calls in charting library bundle are standard; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/widgets/591.js | AI (source-diff): Standard rspack widget chunk; minified library code. | ai | |
| source-diff | obfuscated-file:dist/widgets/165.js | AI (source-diff): Minified react-dom bundle; error URL pattern confirms official React minified build. | ai | |
| source-diff | obfuscated-file:dist/widgets/418.js | AI (source-diff): Minified charting library bundle (gl-matrix, antv); recognizable math/chart exports. | ai | |
| source-diff | net-exec-file:dist/widgets/418.js | AI (source-diff): Network/exec pattern is webpack module loader + charting library; no malicious payload. | ai | |
| source-diff | obfuscated-file:dist/widgets/694.js | AI (source-diff): Minified rspack widget bundle; consistent with legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/widgets/775.js | AI (source-diff): Minified rspack widget bundle; consistent with legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/widgets/919.js | AI (source-diff): Minified rspack widget bundle; consistent with legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/widgets/546.js | AI (source-diff): Minified rspack widget bundle; consistent with legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/widgets/162.js | AI (source-diff): Minified antd bundle; exports match known antd component API surface. | ai | |
| source-diff | net-exec-file:dist/widgets/162.js | AI (source-diff): Network calls are fetch() in React Query hooks; dynamic execution is webpack module system — not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/widgets/405.js | AI (source-diff): Minified React core bundle; Symbol.for react.* patterns confirm legitimate React source. | ai | |
| source-diff | obfuscated-file:dist/widgets/968.js | AI (source-diff): Minified widget bundle; standard rspack build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/__federation_expose_QADashboard.js | AI (source-diff): Standard webpack module federation bundle; readable React/library code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/widgets/117.js | AI (source-diff): Minified Ant Design UI component bundle; expected output from rspack build. | ai | |
| source-diff | obfuscated-file:dist/widgets/338.js | AI (source-diff): Minified React DOM bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/370.js | AI (source-diff): Minified page context/hooks bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/451.js | AI (source-diff): Minified dayjs bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/586.js | AI (source-diff): Minified charting library bundle (G2/AntV); standard build artifact. | ai | |
| source-diff | net-exec-file:dist/widgets/586.js | AI (source-diff): Network calls are chart data fetches; dynamic execution is webpack module loading, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/widgets/626.js | AI (source-diff): Minified React Query bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/781.js | AI (source-diff): Minified widget bundle; standard rspack build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/842.js | AI (source-diff): Minified widget bundle; standard rspack build artifact. | ai | |
| source-diff | net-exec-file:dist/widgets/842.js | AI (source-diff): Same pattern as 586.js; webpack module federation dynamic loading, not malware. | ai | |
| source-diff | obfuscated-file:dist/widgets/997.js | AI (source-diff): Minified widget bundle; standard rspack build artifact. | ai | |
| source-diff | obfuscated-file:dist/widgets/remoteEntry.js | AI (source-diff): Module federation remoteEntry is always minified; expected artifact. | ai | |
| source-diff | net-exec-file:dist/widgets/remoteEntry.js | AI (source-diff): Module federation remote entry uses dynamic loading by design; not dropper behavior. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by new rspack Studio widget chunks added in this version. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): zod is a common transitive/config-level dep in plugin ecosystems; not directly imported but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@kb-labs/plugin-contracts | AI (phantom-deps): Same-org package used via type contracts or re-exports; phantom-dep heuristic is a stable false positive here. | ai |
Versions (showing 51 of 59)
| Version | Deps | Published |
|---|---|---|
| 2.96.0 | 6 / 15 | |
| 2.94.0 | 5 / 14 | |
| 2.93.0 | 5 / 14 | |
| 2.89.0 | 5 / 14 | |
| 2.88.0 | 5 / 14 | |
| 2.87.0 | 5 / 14 | |
| 2.82.0 | 5 / 14 | |
| 2.81.0 | 5 / 14 | |
| 2.80.0 | 5 / 14 | |
| 2.79.0 | 5 / 14 | |
| 2.77.0 | 5 / 14 | |
| 2.75.0 | 5 / 14 | |
| 2.74.0 | 5 / 14 | |
| 2.73.0 | 5 / 14 | |
| 2.72.0 | 5 / 14 | |
| 2.68.0 | 5 / 14 | |
| 2.67.0 | 5 / 14 | |
| 2.66.0 | 5 / 14 | |
| 2.65.0 | 5 / 14 | |
| 2.64.0 | 5 / 14 | |
| 2.62.0 | 5 / 14 | |
| 2.61.0 | 5 / 14 | |
| 2.60.0 | 5 / 14 | |
| 2.59.0 | 5 / 14 | |
| 2.58.0 | 5 / 14 | |
| 2.57.0 | 5 / 14 | |
| 2.56.0 | 5 / 14 | |
| 2.55.0 | 5 / 14 | |
| 2.54.0 | 5 / 14 | |
| 2.53.0 | 5 / 14 | |
| 2.47.0 | 5 / 14 | |
| 2.46.0 | 5 / 14 | |
| 2.45.0 | 5 / 14 | |
| 2.44.0 | 5 / 14 | |
| 2.43.0 | 5 / 14 | |
| 2.42.0 | 5 / 14 | |
| 2.41.0 | 5 / 14 | |
| 2.40.0 | 5 / 14 | |
| 2.39.0 | 5 / 14 | |
| 2.38.0 | 5 / 14 | |
| 2.37.0 | 5 / 14 | |
| 2.36.0 | 5 / 14 | |
| 2.35.0 | 5 / 14 | |
| 2.34.0 | 5 / 14 | |
| 2.33.0 | 5 / 14 | |
| 2.32.0 | 5 / 14 | |
| 2.31.0 | 5 / 14 | |
| 2.30.0 | 5 / 14 | |
| 2.29.0 | 5 / 14 | |
| 2.28.0 | 5 / 14 | |
| 2.25.0 | 5 / 14 |
v2.96.0
9 findings
HIGH
New obfuscated file: dist/widgets/215.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/widgets/46.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/widgets/46.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
New obfuscated file: dist/widgets/62.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/widgets/62.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
New obfuscated file: dist/widgets/648.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/widgets/78.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/widgets/823.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.