@lmvz-ds/components
The components of the design system
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:cjs/lmvz-toggle.cjs.entry.js | AI (source-diff): Minified Stencil build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-c3b7890d.entry.js | AI (source-diff): Minified Stencil build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:components/lmvz-toggle.js | AI (source-diff): Minified Stencil build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:esm/lmvz-toggle.entry.js | AI (source-diff): Minified Stencil build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cjs/index-QRnWYctw.js | AI (source-diff): Bundled CJS build output with readable source, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/esm/index-CekEw3_K.js | AI (source-diff): Bundled build output, no malicious behavior evidenced. | ai | |
| source-diff | obfuscated-file:dist/esm/index-CekEw3_K.js | AI (source-diff): Bundled build output (rollup-style renamed exports), not obfuscation. | ai | |
| source-diff | net-exec-file:dist/esm/Effect-DyamyJqO.js | AI (source-diff): Generic bundled utility code, no malicious network/exec behavior. | ai | |
| source-diff | obfuscated-file:dist/esm/Effect-DyamyJqO.js | AI (source-diff): Bundled effect library output, not true obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Same-org first-party dependency (@lmvz-ds/aria-validation). | ai | |
| source-diff | net-exec-file:dist/cjs/Effect-CpZhfb0D.js | AI (source-diff): Bundled effect library file, readable JSDoc source, not a dropper. | ai | |
| source-diff | net-exec-file:dist/cjs/index-QRnWYctw.js | AI (source-diff): Bundled build output, no malicious behavior evidenced. | ai | |
| source-diff | net-exec-file:dist/esm/icons-CM7lsnuO.js | AI (source-diff): Effect library bundle; no malicious network/exec target found in sample. | ai | |
| source-diff | net-exec-file:dist/cjs/Effect-CNhHt4Xb.js | AI (source-diff): Bundled library code; no fetch+exec dropper behavior in sample. | ai | |
| source-diff | net-exec-file:dist/esm/Effect-BhQLGXPs.js | AI (source-diff): Bundled library code; no fetch+exec dropper behavior in sample. | ai | |
| source-diff | obfuscated-file:dist/esm/Effect-BhQLGXPs.js | AI (source-diff): Minified bundled effect lib code, not true obfuscation. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Inside bundled axe-core accessibility engine, standard for that library. | ai | |
| source-diff | net-exec-file:cjs/index-Bn3k5SiE.js | AI (source-diff): False positive on bundled library code. | ai | |
| source-diff | obfuscated-file:cjs/index-Bn3k5SiE.js | AI (source-diff): Bundled build output, not obfuscation. | ai | |
| source-diff | net-exec-file:esm/index-7ULiPTL_.js | AI (source-diff): False positive on bundled library code, no actual dropper behavior. | ai | |
| source-diff | obfuscated-file:esm/index-7ULiPTL_.js | AI (source-diff): Bundled build output (effect/rollup), not true obfuscation. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Inside bundled axe-core, not attacker obfuscation. | ai | |
| source-diff | net-exec-file:dist/cjs/assets-CB5ikzmP.js | AI (source-diff): Bundled effect library internals, no fetch+eval malicious pattern. | ai | |
| source-diff | obfuscated-file:dist/lmvz-components/p-16878d4c.entry.js | AI (source-diff): Stencil bundled component output, not obfuscation. | ai | |
| source-diff | net-exec-file:lmvz-components/p-CGmJG63p.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | obfuscated-file:cjs/index-3g9Z9sfF.js | AI (source-diff): Minified Stencil/effect bundle; long lines are CSS strings and fp-ts imports, not obfuscation. | ai | |
| source-diff | net-exec-file:cjs/index-3g9Z9sfF.js | AI (source-diff): Network+exec pattern fires on bundled effect library code; no actual dropper behavior in samples. | ai | |
| source-diff | obfuscated-file:esm/index-Dh_9sN0q.js | AI (source-diff): Same bundled effect/Stencil output; false positive. | ai | |
| source-diff | net-exec-file:esm/index-Dh_9sN0q.js | AI (source-diff): False positive on bundled effect library; no dropper behavior. | ai | |
| source-diff | obfuscated-file:esm/logger-CGmJG63p.js | AI (source-diff): Minified logger bundle; false positive. | ai | |
| source-diff | net-exec-file:esm/logger-CGmJG63p.js | AI (source-diff): False positive on bundled logger code. | ai | |
| source-diff | net-exec-file:cjs/logger-DsM6xg6V.js | AI (source-diff): False positive on bundled logger code. | ai | |
| source-diff | net-exec-file:components/p-0s99QfRy.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | net-exec-file:lmvz-components/p-0s99QfRy.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | net-exec-file:components/p-CGmJG63p.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-6e8acbd9.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | net-exec-file:esm/logger-0bL3pydp.js | AI (source-diff): Same Effect-TS bundle; false positive for this design system package. | ai | |
| source-diff | obfuscated-file:esm/logger-0bL3pydp.js | AI (source-diff): Bundled Effect-TS logger; minified library code, not obfuscated malware. | ai | |
| source-diff | net-exec-file:esm/index-BvxaUA12.js | AI (source-diff): Effect-TS bundle; network/exec patterns are library internals, not dropper behavior. | ai | |
| source-diff | obfuscated-file:esm/index-BvxaUA12.js | AI (source-diff): Stencil/Vite bundled output of Effect-TS library; minified but not malicious. | ai | |
| source-diff | obfuscated-file:components/p-DbeHBSOe.js | AI (source-diff): Stencil build output; false positive. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-9626e951.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-ec96c6b6.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-e1b847d2.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-BxHnZA0M.js | AI (source-diff): Stencil shared chunk; minified build artifact. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-49ab22bd.entry.js | AI (source-diff): Stencil entry chunk; icon component with IntersectionObserver, not malware. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-40569208.entry.js | AI (source-diff): Stencil entry chunk for web component; standard minified output. | ai | |
| source-diff | net-exec-file:lmvz-components/p-DHZwxmLb.js | AI (source-diff): Stencil chunk; false positive for this design system. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-DHZwxmLb.js | AI (source-diff): Stencil build chunk; minified web component code. | ai | |
| source-diff | net-exec-file:lmvz-components/p-0bL3pydp.js | AI (source-diff): Same Stencil/Effect-TS chunk; false positive. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-0bL3pydp.js | AI (source-diff): Stencil chunk of Effect-TS; minified build artifact. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-0a41cc24.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-30b99f11.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-5aa17cd2.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-6dbb3f13.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-84267405.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-7a6bec13.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| provenance | no-provenance | AI (provenance): Internal enterprise design system; provenance attestation not expected for this publisher/scope. | ai | |
| license | uncommon-license:UNLICENSED | AI (license): Intentionally proprietary/internal package; UNLICENSED is consistent across all versions. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-80675ee5.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-872e2106.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-93038c98.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-bbab5471.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-c7e368c4.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-1506fa34.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output; minified but readable component logic, not malicious obfuscation. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 0.36.1 | 2 / 0 | |
| 0.23.0 | 2 / 0 | |
| 0.22.0 | 2 / 0 | |
| 0.21.0 | 2 / 0 | |
| 0.20.0 | 2 / 0 | |
| 0.19.0 | 2 / 0 | |
| 0.18.2 | 2 / 0 | |
| 0.18.1 | 2 / 0 | |
| 0.18.0 | 2 / 0 | |
| 0.17.1 | 3 / 23 | |
| 0.17.0 | 3 / 23 | |
| 0.13.3 | 3 / 20 | |
| 0.13.1 | 3 / 20 | |
| 0.13.0 | 3 / 20 | |
| 0.12.4 | 2 / 24 | |
| 0.12.2 | 2 / 24 | |
| 0.12.1 | 2 / 24 | |
| 0.12.0 | 2 / 24 | |
| 0.11.4 | 2 / 24 |
v0.36.1
14 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.21.0
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.3
25 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.1
15 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.0
17 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.4
16 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.