← Home

@lottiefiles/dotlottie-web

npm Repository Homepage
13
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jawishnattuadnan

Keywords

dotlottielottieplayeranimationwebcanvasjavascriptthorvg

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/webgl/index.cjs AI (source-diff): Standard wasm-bindgen minified glue code for WebGL renderer; not obfuscation. ai
source-diff net-exec-file:dist/webgl/index.cjs AI (source-diff): Network calls are fetch for wasm binary; dynamic execution is wasm instantiation — expected for this package. ai
source-diff obfuscated-file:dist/webgpu/index.cjs AI (source-diff): Standard wasm-bindgen minified glue code for WebGPU renderer; not obfuscation. ai
source-diff net-exec-file:dist/webgpu/index.cjs AI (source-diff): Network calls are fetch for wasm binary; dynamic execution is wasm instantiation — expected for this package. ai
source-diff obfuscated-file:dist/webgl/index.js AI (source-diff): Standard wasm-bindgen minified glue code; ESM variant of WebGL renderer. ai
source-diff net-exec-file:dist/webgl/index.js AI (source-diff): Same wasm fetch/instantiate pattern as CJS variant; expected for this package. ai
source-diff obfuscated-file:dist/webgpu/index.js AI (source-diff): Standard wasm-bindgen minified glue code; ESM variant of WebGPU renderer. ai
source-diff net-exec-file:dist/webgpu/index.js AI (source-diff): Same wasm fetch/instantiate pattern as CJS variant; expected for this package. ai
provenance publisher-changed AI (provenance): Package uses GitHub Actions CI/CD with SLSA provenance; automated publisher is expected and attested. ai

Versions (showing 13 of 13)

Version Deps Published
0.74.0 0 / 9
0.73.0 0 / 9
0.72.1 0 / 9
0.72.0 0 / 9
0.71.0 0 / 9
0.70.0 0 / 9
0.69.0 0 / 9
0.68.0 0 / 9
0.65.0 0 / 8
0.64.2 0 / 8
0.64.1 0 / 8
0.64.0 0 / 8
0.50.2 0 / 10

v0.74.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.73.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.72.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.72.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.70.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.69.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.68.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.