← Home

@lottiefiles/dotlottie-wc

npm Repository Homepage
93
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jawishnattuadnan

Keywords

dotlottielottieplayeranimationwebcanvasjavascriptlottiefilesdotlottie-webthorvgweb-component

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/dotlottie-Cn4v_pQB-CBtBMv4n.js AI (source-diff): Minified dotlottie-web WASM binding; standard build output for this package. ai
source-diff obfuscated-file:dist/dist-BtTeeiEn.js AI (source-diff): Minified dotlottie-web bundle; standard build output for this package. ai
source-diff obfuscated-file:dist/dist-MOs0qH2M.js AI (source-diff): Minified dotlottie-web bundle with recognizable @lottiefiles/dotlottie-web internals; standard build artifact. ai
source-diff obfuscated-file:dist/dist-BMnS_qxa.js AI (source-diff): Standard minified bundle with source map; consistent with tsdown build output for this package. ai
source-diff obfuscated-file:dist/dist-BLkQfkLV.js AI (source-diff): Standard bundled/minified dist output for this package; not obfuscation. ai
source-diff obfuscated-file:dist/dist-CDWQCGVs.js AI (source-diff): Standard minified bundle output for this package; SLSA provenance confirms CI/CD build integrity. ai
source-diff obfuscated-file:dist/dist-BnVItZne.js AI (source-diff): Minified dotlottie-web bundle with WASM; standard build artifact for this package. ai
source-diff net-exec-file:dist/chunk-B6AP7WKV.js AI (source-diff): WASM loader bundle for dotlottie-web; fetch+WebAssembly execution is the documented runtime pattern for this package. ai
source-diff obfuscated-file:dist/dist-DHjsgXjJ.js AI (source-diff): Minified dotlottie-web bundle with recognizable @lottiefiles/dotlottie-web internals; expected build artifact. ai
source-diff obfuscated-file:dist/dist-CDsU-l1k.js AI (source-diff): Standard minified bundle with accompanying source map; readable Babel/WASM glue code, not obfuscation. ai
source-diff obfuscated-file:dist/dotlottie-DBBPxC2A-By124qvu.js AI (source-diff): Minified dotlottie-web WASM binding code; standard build artifact. ai
source-diff obfuscated-file:dist/dist-XO1b9DBD.js AI (source-diff): Minified dotlottie-web bundle with inline Worker; standard build artifact. ai
source-diff obfuscated-file:dist/dist-CKe9q9bt.js AI (source-diff): Minified dotlottie-web WASM binding bundle; standard build artifact matching declared dependency @lottiefiles/[email protected]. ai
source-diff obfuscated-file:dist/dist-DO_wn7qf.js AI (source-diff): Minified dotlottie-web bundle; standard build artifact, content matches expected library code. ai
source-diff obfuscated-file:dist/decorate-C0oFmnNg.js AI (source-diff): Minified Lit framework code; standard build artifact for this web component package. ai
phantom-deps phantom-dep:@lottiefiles/dotlottie-web AI (phantom-deps): Same-org dep bundled into dist; phantom-dep heuristic is a stable false positive for this package. ai
phantom-deps phantom-dep:lit AI (phantom-deps): lit is bundled into dist output; not directly imported in source but legitimately used as a runtime dep. ai
source-diff obfuscated-file:dist/dist-GOJJVOuh.js AI (source-diff): Standard minified dotlottie-web bundle; expected build artifact for this package. ai
source-diff obfuscated-file:dist/decorate-DwnJ77rs.js AI (source-diff): Standard minified Lit framework output with license headers; expected build artifact for this package. ai
provenance slsa-provenance AI (provenance): Package consistently publishes via CI/CD with SLSA provenance; stable pattern for this org. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions publisher is consistent with SLSA provenance attestation from official repo. ai

Versions (showing 93 of 93)

Version Deps Published
0.9.24 2 / 6
0.9.23 2 / 6
0.9.22 2 / 6
0.9.16 2 / 6
0.9.15 2 / 6
0.9.14 2 / 6
0.9.13 2 / 6
0.9.12 2 / 6
0.9.11 2 / 6
0.9.10 2 / 6
0.9.9 2 / 6
0.9.8 2 / 6
0.9.7 2 / 6
0.9.6 2 / 6
0.9.5 2 / 6
0.9.4 2 / 6
0.9.3 2 / 6
0.9.2 2 / 6
0.9.1 2 / 6
0.9.0 2 / 6
0.8.16 2 / 7
0.8.15 2 / 7
0.8.14 2 / 7
0.8.13 2 / 7
0.8.11 2 / 7
0.8.10 2 / 7
0.8.9 2 / 7
0.8.8 2 / 7
0.8.7 2 / 7
0.8.6 2 / 7
0.8.5 2 / 7
0.8.4 2 / 7
0.8.3 2 / 7
0.8.2 2 / 7
0.8.1 2 / 7
0.8.0 2 / 7
0.7.7 2 / 7
0.7.6 2 / 7
0.7.5 2 / 7
0.7.4 2 / 7
0.7.3 2 / 7
0.7.2 2 / 7
0.7.1 2 / 7
0.7.0 2 / 7
0.6.4 2 / 7
0.6.3 2 / 7
0.6.2 2 / 7
0.6.1 2 / 7
0.6.0 2 / 7
0.5.3 2 / 7
0.5.2 2 / 7
0.5.1 2 / 7
0.5.0 2 / 7
0.4.6 2 / 7
0.4.5 2 / 7
0.4.4 2 / 7
0.4.3 2 / 7
0.4.2 2 / 7
0.4.1 2 / 7
0.4.0 2 / 7
0.3.2 2 / 3
0.3.1 2 / 3
0.3.0 2 / 3
0.2.24 2 / 3
0.2.23 2 / 3
0.2.22 2 / 3
0.2.21 2 / 3
0.2.20 2 / 3
0.2.19 2 / 3
0.2.18 2 / 3
0.2.17 2 / 3
0.2.16 2 / 3
0.2.15 2 / 3
0.2.14 2 / 3
0.2.13 2 / 3
0.2.12 2 / 3
0.2.11 2 / 3
0.2.10 2 / 3
0.2.9 2 / 3
0.2.8 2 / 3
0.2.7 2 / 3
0.2.6 2 / 3
0.2.5 2 / 3
0.2.4 2 / 3
0.2.3 2 / 3
0.2.2 2 / 3
0.2.1 2 / 3
0.2.0 2 / 3
0.1.9 2 / 3
0.1.8 2 / 3
0.1.7 2 / 3
0.1.6 2 / 3
0.1.5 2 / 3

v0.9.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.23

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.22

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.24

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.