@likec4/language-server
LikeC4 Language Server
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/generated/ast.js | AI (source-diff): Langium-generated AST types, long lines are generated code not obfuscation. | ai | |
| source-diff | net-exec-file:dist/bundled.mjs | AI (source-diff): Bundled build output from legitimate deps (langium/vscode-languageserver), not a dropper. | ai | |
| source-diff | obfuscated-file:dist/generated/grammar.js | AI (source-diff): Langium-generated grammar JSON string, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/shared/language-server.DKV_FdPN.cjs | AI (source-diff): Bundled build chunk (unbuild/rollup), not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/shared/language-server.BIbAD1T-.mjs | AI (source-diff): Bundled build chunk (unbuild/rollup), not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/shared/language-server.B8qSDsWW.mjs | AI (source-diff): Bundled build chunk with standard imports, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/shared/language-server.DZRuJVSg.cjs | AI (source-diff): CJS counterpart of same bundled build chunk. | ai | |
| source-diff | obfuscated-file:dist/generated-lib/icons.mjs | AI (source-diff): Generated static icon-name list, long line is data not obfuscation. | ai | |
| phantom-deps | phantom-dep:bundle-require | AI (phantom-deps): Used in config files, not direct import; expected. | ai | |
| phantom-deps | phantom-dep:esbuild | AI (phantom-deps): Known implicit runtime/binary dependency. | ai | |
| source-diff | obfuscated-file:dist/generated/grammar.mjs | AI (source-diff): Generated Langium grammar JSON blob, not obfuscation; part of documented build step. | ai | |
| source-diff | obfuscated-file:dist/shared/language-server.CrE0nFSB.mjs | AI (source-diff): Minified bundler output with readable imports, not true obfuscation. | ai | |
| phantom-deps | phantom-dep:p-debounce | AI (phantom-deps): Used via config/build indirection, consistent with monorepo pattern. | ai | |
| source-diff | obfuscated-file:dist/shared/language-server.C2ebP2pZ.cjs | AI (source-diff): Minified bundler output with readable requires, not true obfuscation. | ai | |
| phantom-deps | phantom-dep:@hpcc-js/wasm-graphviz | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:hono | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:@hono/mcp | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:strip-indent | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:indent-string | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:@hono/node-server | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:vscode-languageserver-textdocument | AI (phantom-deps): Phantom-dep heuristic; referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:json5 | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:immer | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:fdir | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:defu | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:ufo | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:picomatch | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:p-timeout | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:std-env | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:p-queue | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:p-limit | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:remeda | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:which | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:pretty-ms | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:unstorage | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:nano-spawn | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:@likec4/log | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic is a false positive for monorepo packages. | ai | |
| phantom-deps | phantom-dep:fast-equals | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai | |
| phantom-deps | phantom-dep:pathe | AI (phantom-deps): Monorepo bundled package; phantom-dep heuristic fires on bundled/re-exported deps. | ai |
Versions (showing 51 of 72)
| Version | Deps | Published |
|---|---|---|
| 1.58.0 | 35 / 18 | |
| 1.57.0 | 35 / 18 | |
| 1.56.0 | 34 / 17 | |
| 1.55.1 | 34 / 17 | |
| 1.55.0 | 34 / 17 | |
| 1.54.0 | 35 / 18 | |
| 1.47.0 | 3 / 52 | |
| 1.46.4 | 3 / 52 | |
| 1.46.3 | 3 / 52 | |
| 1.46.2 | 3 / 52 | |
| 1.46.0 | 3 / 52 | |
| 1.45.0 | 3 / 52 | |
| 1.44.0 | 3 / 51 | |
| 1.43.0 | 3 / 50 | |
| 1.42.1 | 3 / 50 | |
| 1.42.0 | 3 / 50 | |
| 1.41.0 | 3 / 50 | |
| 1.40.0 | 3 / 50 | |
| 1.39.5 | 3 / 50 | |
| 1.39.4 | 3 / 50 | |
| 1.39.3 | 3 / 50 | |
| 1.39.2 | 3 / 50 | |
| 1.39.1 | 3 / 50 | |
| 1.39.0 | 3 / 50 | |
| 1.38.1 | 1 / 50 | |
| 1.38.0 | 1 / 50 | |
| 1.37.0 | 1 / 46 | |
| 1.36.1 | 1 / 46 | |
| 1.36.0 | 1 / 46 | |
| 1.35.0 | 1 / 45 | |
| 1.34.2 | 1 / 45 | |
| 1.34.1 | 1 / 45 | |
| 1.34.0 | 1 / 45 | |
| 1.33.0 | 1 / 45 | |
| 1.32.2 | 1 / 45 | |
| 1.32.1 | 1 / 45 | |
| 1.32.0 | 1 / 45 | |
| 1.31.0 | 3 / 41 | |
| 1.23.1 | 1 / 34 | |
| 1.22.1 | 1 / 33 | |
| 1.21.1 | 0 / 33 | |
| 1.21.0 | 0 / 35 | |
| 1.20.3 | 0 / 35 | |
| 1.20.2 | 0 / 35 | |
| 1.20.1 | 21 / 14 | |
| 1.20.0 | 21 / 14 | |
| 1.19.2 | 21 / 14 | |
| 1.19.1 | 21 / 14 | |
| 1.19.0 | 19 / 13 | |
| 1.17.1 | 20 / 14 | |
| 1.17.0 | 20 / 14 |
v1.43.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.42.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.41.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.40.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.39.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.1
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: davydkov.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.1
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.1
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.0
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.3
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.2
3 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.