@lottiefiles/dotlottie-web
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@dotlottie/dotlottie-js | AI (dependencies): First-party LottieFiles dependency, same org/monorepo. | ai | |
| phantom-deps | phantom-dep:@dotlottie/dotlottie-js | AI (phantom-deps): Sibling LottieFiles package, used in bundled build; not a supply-chain injection vector. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Legacy initial version of long-established, widely-used package; not a fresh throwaway. | ai | |
| source-diff | obfuscated-file:dist/dotlottie-DBBPxC2A.js | AI (source-diff): Minified wasm-bindgen glue from tsdown build; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/dotlottie-ls0cVLtn.cjs | AI (source-diff): Minified wasm-bindgen glue from tsdown build; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/dotlottie-Cn4v_pQB.js | AI (source-diff): Minified wasm-bindgen build output, hashed filename; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/dotlottie-DAqJ7ZaP.cjs | AI (source-diff): Minified wasm-bindgen build output, hashed filename; not obfuscation. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): WASM player engine is core to this renderer; stable across versions. | ai | |
| source-diff | obfuscated-file:dist/webgl/index.cjs | AI (source-diff): Standard wasm-bindgen minified glue code for WebGL renderer; not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Package uses GitHub Actions CI/CD with SLSA provenance; automated publisher is expected and attested. | ai | |
| source-diff | net-exec-file:dist/webgl/index.cjs | AI (source-diff): Network calls are fetch for wasm binary; dynamic execution is wasm instantiation — expected for this package. | ai | |
| source-diff | obfuscated-file:dist/webgpu/index.cjs | AI (source-diff): Standard wasm-bindgen minified glue code for WebGPU renderer; not obfuscation. | ai | |
| source-diff | net-exec-file:dist/webgpu/index.cjs | AI (source-diff): Network calls are fetch for wasm binary; dynamic execution is wasm instantiation — expected for this package. | ai | |
| source-diff | obfuscated-file:dist/webgl/index.js | AI (source-diff): Standard wasm-bindgen minified glue code; ESM variant of WebGL renderer. | ai | |
| source-diff | net-exec-file:dist/webgl/index.js | AI (source-diff): Same wasm fetch/instantiate pattern as CJS variant; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/webgpu/index.js | AI (source-diff): Standard wasm-bindgen minified glue code; ESM variant of WebGPU renderer. | ai | |
| source-diff | net-exec-file:dist/webgpu/index.js | AI (source-diff): Same wasm fetch/instantiate pattern as CJS variant; expected for this package. | ai |
Versions (showing 78 of 78)
| Version | Deps | Published |
|---|---|---|
| 0.78.2 | 0 / 9 | |
| 0.78.1 | 0 / 9 | |
| 0.78.0 | 0 / 9 | |
| 0.77.1 | 0 / 9 | |
| 0.77.0 | 0 / 9 | |
| 0.76.0 | 0 / 9 | |
| 0.75.0 | 0 / 9 | |
| 0.74.0 | 0 / 9 | |
| 0.73.0 | 0 / 9 | |
| 0.72.1 | 0 / 9 | |
| 0.72.0 | 0 / 9 | |
| 0.71.0 | 0 / 9 | |
| 0.70.0 | 0 / 9 | |
| 0.69.0 | 0 / 9 | |
| 0.68.0 | 0 / 9 | |
| 0.67.0 | 0 / 9 | |
| 0.66.2 | 0 / 9 | |
| 0.66.1 | 0 / 9 | |
| 0.66.0 | 0 / 9 | |
| 0.65.0 | 0 / 8 | |
| 0.64.2 | 0 / 8 | |
| 0.64.1 | 0 / 8 | |
| 0.64.0 | 0 / 8 | |
| 0.63.0 | 0 / 10 | |
| 0.62.0 | 0 / 10 | |
| 0.61.0 | 0 / 10 | |
| 0.60.0 | 0 / 10 | |
| 0.58.1 | 0 / 10 | |
| 0.58.0 | 0 / 10 | |
| 0.57.0 | 0 / 10 | |
| 0.56.0 | 0 / 10 | |
| 0.50.2 | 0 / 10 | |
| 0.41.0 | 0 / 10 | |
| 0.40.2 | 0 / 10 | |
| 0.40.1 | 0 / 10 | |
| 0.40.0 | 0 / 10 | |
| 0.35.0 | 0 / 10 | |
| 0.33.0 | 0 / 10 | |
| 0.32.0 | 0 / 10 | |
| 0.31.1 | 0 / 10 | |
| 0.31.0 | 0 / 10 | |
| 0.30.3 | 0 / 10 | |
| 0.30.2 | 0 / 10 | |
| 0.30.1 | 0 / 10 | |
| 0.30.0 | 0 / 10 | |
| 0.29.2 | 0 / 8 | |
| 0.29.1 | 0 / 8 | |
| 0.29.0 | 0 / 8 | |
| 0.28.0 | 0 / 8 | |
| 0.27.0 | 0 / 8 | |
| 0.26.0 | 0 / 8 | |
| 0.25.0 | 0 / 8 | |
| 0.24.0 | 0 / 8 | |
| 0.23.2 | 0 / 8 | |
| 0.23.1 | 0 / 8 | |
| 0.23.0 | 0 / 8 | |
| 0.22.0 | 0 / 8 | |
| 0.21.1 | 0 / 8 | |
| 0.21.0 | 0 / 8 | |
| 0.20.2 | 0 / 8 | |
| 0.20.1 | 0 / 8 | |
| 0.20.0 | 0 / 8 | |
| 0.19.0 | 0 / 8 | |
| 0.18.1 | 0 / 8 | |
| 0.18.0 | 0 / 8 | |
| 0.17.0 | 0 / 8 | |
| 0.16.0 | 0 / 8 | |
| 0.15.0 | 0 / 8 | |
| 0.14.1 | 0 / 8 | |
| 0.14.0 | 0 / 8 | |
| 0.13.0 | 0 / 8 | |
| 0.10.0 | 1 / 9 | |
| 0.8.0 | 1 / 3 | |
| 0.3.1 | 1 / 6 | |
| 0.3.0 | 1 / 6 | |
| 0.2.0 | 1 / 6 | |
| 0.1.0 | 1 / 6 | |
| 0.0.0 | 0 / 5 |
v0.78.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.78.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.78.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.77.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.77.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.76.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.67.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm • dist/webgl/dotlottie-player.wasm • dist/webgpu/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.66.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm • dist/webgl/dotlottie-player.wasm • dist/webgpu/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.66.1
4 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm • dist/webgl/dotlottie-player.wasm • dist/webgpu/dotlottie-player.wasm
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.66.0
4 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm • dist/webgl/dotlottie-player.wasm • dist/webgpu/dotlottie-player.wasm
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.63.0
3 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-02-12. This could indicate a legitimate maintainer transition or an account compromise.
v0.62.0
3 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-02-05. This could indicate a legitimate maintainer transition or an account compromise.
v0.61.0
3 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-01-14. This could indicate a legitimate maintainer transition or an account compromise.
v0.60.0
3 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2025-12-25. This could indicate a legitimate maintainer transition or an account compromise.
v0.58.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.58.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.57.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.56.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.41.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.40.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.40.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.40.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.35.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.33.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.32.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.31.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.3
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.30.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.29.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.28.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.27.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.21.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist/dotlottie-player.wasm
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.20.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.19.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.13.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.10.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.