@ls-stack/agent-eval
51
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
lucasols
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-Dc-Gw91w.js | AI (source-diff): Bundled web dashboard asset, no exfil behavior found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Dc-Gw91w.js | AI (source-diff): Vite/Shiki bundled web asset; minified, not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-PTikBbhf.js | AI (source-diff): Bundled web dashboard asset; no malicious network+exec behavior observed. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-PTikBbhf.js | AI (source-diff): Vite bundle chunk-map, minified build output not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-SP4kEtYL.mjs | AI (source-diff): CLI bundle using standard node fs/child_process/glob, not dropper code. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DXwsn7Tw.js | AI (source-diff): Vite bundle of a web UI (shiki language chunks), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-B3RRNT7b.mjs | AI (source-diff): CLI code using fs/child_process for its documented eval-runner function, not malicious. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DXwsn7Tw.js | AI (source-diff): Bundled web asset; no malicious network+exec behavior found in sample. | ai | |
| source-diff | net-exec-file:dist/cli-BR3wMZMx.mjs | AI (source-diff): CLI bundle imports legit deps (chokidar, glob, child_process) matching package's stated function. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CvsPmlHl.js | AI (source-diff): Bundled web app; network+dynamic-import is normal chunk loading, no exfil target. | ai | |
| source-diff | net-exec-file:dist/cli-rvPrUj6S.mjs | AI (source-diff): CLI bundle using child_process/glob/chokidar per stated eval-runner functionality. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CvsPmlHl.js | AI (source-diff): Vite/Rollup bundled web UI asset (shiki chunk map), not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-B3ViW9uS.js | AI (source-diff): Vite-bundled web UI asset, minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-B3ViW9uS.js | AI (source-diff): Bundled web asset; no malicious network/exec behavior found. | ai | |
| source-diff | net-exec-file:dist/cli-ClAkjTvo.mjs | AI (source-diff): CLI bundle using node builtins for its documented eval-runner functionality. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DkmGiclc.js | AI (source-diff): Bundled web asset; network+dynamic-import calls are normal Vite chunk loading. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DkmGiclc.js | AI (source-diff): Vite bundle with vendored shiki language chunks; long lines are minification, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-C7QjETk8.js | AI (source-diff): Vite-bundled web dashboard asset with long lines; not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-Bu9347r1.mjs | AI (source-diff): CLI bundle uses child_process/node builtins for its documented eval-runner function. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-C7QjETk8.js | AI (source-diff): Bundled web asset, network+exec pattern is normal bundler chunk loading. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CE1teCsp.js | AI (source-diff): Bundled web dashboard asset; no concrete malicious network/exec target found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CE1teCsp.js | AI (source-diff): Vite bundle output (code-split map, syntax-highlighter chunks), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-CCHcjbC1.mjs | AI (source-diff): CLI bundle using standard deps (chokidar, glob, child_process) for its stated eval-runner function. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Dowobz-z.js | AI (source-diff): Vite/shiki bundled web asset, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-Dowobz-z.js | AI (source-diff): Bundled frontend asset; net+exec pattern from bundler code, no malicious target. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CwSehYad.js | AI (source-diff): Vite-bundled web UI asset, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CwSehYad.js | AI (source-diff): Bundled web asset; no malicious network/exec behavior found. | ai | |
| source-diff | net-exec-file:dist/cli-Co6DFBN8.mjs | AI (source-diff): tsdown-bundled CLI using node fs/child_process for its documented eval-runner function. | ai | |
| source-diff | net-exec-file:dist/cli-BcIYR5jZ.mjs | AI (source-diff): CLI entry legitimately uses fs/child_process/network for its stated eval-runner function. | ai | |
| source-diff | net-exec-file:dist/cli-Br9BfDXU.mjs | AI (source-diff): CLI uses node builtins (child_process/fs) for its stated eval-runner function. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-D1pyL3XD.js | AI (source-diff): Bundled web asset; no malicious network+exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-D1pyL3XD.js | AI (source-diff): Vite bundle chunk-map for a web app, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-bB8IBDp1.js | AI (source-diff): Bundled web app; network/eval patterns are from syntax-highlighter libs, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-bB8IBDp1.js | AI (source-diff): Vite-bundled web asset with long lines; minified build output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-DQO2Fpt2.mjs | AI (source-diff): Bundled CLI using node:child_process/fs as documented for a local eval-runner tool. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CfSiAVmi.js | AI (source-diff): Bundled web app output; no concrete malicious network/exec behavior shown. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CfSiAVmi.js | AI (source-diff): Vite-bundled web asset (chunk map, syntax-highlighter deps), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-f_7okXGO.mjs | AI (source-diff): tsdown-bundled CLI using standard node builtins for its documented function. | ai | |
| source-diff | net-exec-file:dist/cli-hIETCdT0.mjs | AI (source-diff): CLI bundle importing standard node builtins/child_process for legitimate CLI functionality. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CRZO3t6H.js | AI (source-diff): Bundled web asset; no evidence of malicious network+exec behavior beyond bundler code. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CRZO3t6H.js | AI (source-diff): Vite-bundled web UI asset (shiki syntax-highlighter chunk map), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-C0fcKVLr.mjs | AI (source-diff): CLI entry using node builtins/child_process for its own eval-runner functionality, not exfil. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BXFsxHVc.js | AI (source-diff): Bundled web asset; network+exec pattern is normal bundler code, no hostile target. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BXFsxHVc.js | AI (source-diff): Vite bundle with long chunk-map lines, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-Bf5RzM8O.mjs | AI (source-diff): CLI bundle uses child_process/fs for its own eval-running functionality, not exfil. | ai | |
| source-diff | net-exec-file:dist/cli-OLZIjQpx.mjs | AI (source-diff): Legit CLI bundle importing node builtins/glob/chokidar; dual-use, not malicious. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BD6FXk5p.js | AI (source-diff): Bundled web app asset; no dropper behavior found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BD6FXk5p.js | AI (source-diff): Vite/shiki bundled web asset, long lines are minification not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CM6MDNqo.js | AI (source-diff): Bundled SPA code with dynamic imports/fetch, no hostile destination shown. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CM6MDNqo.js | AI (source-diff): Vite bundle banner + long minified lines; consistent with bundled web asset, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-BSVUCUxr.mjs | AI (source-diff): CLI bundle importing project's own compiled modules; child_process/fs use fits stated CLI function. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-z9E94a3e.js | AI (source-diff): Bundled frontend asset; no dropper/exfil behavior in sample. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-z9E94a3e.js | AI (source-diff): Vite-bundled web asset with code-splitting map, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-DN6j4gRP.mjs | AI (source-diff): tsdown-bundled CLI entry importing normal node builtins/deps for stated CLI function. | ai | |
| source-diff | net-exec-file:dist/cli-Cf37PZKi.mjs | AI (source-diff): CLI bundle imports node builtins/child_process for legitimate eval-runner tooling. | ai | |
| source-diff | net-exec-file:dist/cli-D7FdRe1p.mjs | AI (source-diff): CLI's own bundled entry using node:child_process for its stated eval-runner function. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CtS15NHS.js | AI (source-diff): Bundled frontend asset, no malicious network+exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CtS15NHS.js | AI (source-diff): Vite-bundled web asset with long minified lines; not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BPdomO6V.js | AI (source-diff): Vite bundle output (chunk map with syntax-highlighter langs), not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BPdomO6V.js | AI (source-diff): Bundled web app asset; no malicious exfil behavior evident. | ai | |
| source-diff | net-exec-file:dist/cli-B_1vGzOJ.mjs | AI (source-diff): CLI bundle uses standard node child_process/fs/crypto for its own eval-runner functionality. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-xjKxDr-h.js | AI (source-diff): Bundled Vite web asset (syntax-highlighter chunk map), not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-xjKxDr-h.js | AI (source-diff): Bundled web app asset; network/exec calls are legit UI code, no exfil target. | ai | |
| source-diff | net-exec-file:dist/cli-DbVfkr9T.mjs | AI (source-diff): CLI bundle uses legit deps (chokidar, glob, child_process) for its own runner functionality. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CANDLTsq.js | AI (source-diff): Bundled fetch is standard Vite modulepreload polyfill. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CANDLTsq.js | AI (source-diff): Vite-bundled web asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CimthgI7.mjs | AI (source-diff): tsdown/rollup bundled output for the eval runner, matches build config. | ai | |
| source-diff | net-exec-file:dist/cli-D3QNOcPN.mjs | AI (source-diff): CLI uses git/child_process for local eval orchestration, not a dropper. | ai | |
| source-diff | net-exec-file:dist/cli-DLlRkyLH.mjs | AI (source-diff): CLI bundle using node builtins/chokidar for its documented eval-runner function. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-o4o2EktS.js | AI (source-diff): Vite-bundled web UI asset, minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/cli-Ck0mqxd-.mjs | AI (source-diff): CLI's own bundled module graph; child_process/fs use is core tool functionality. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-o4o2EktS.js | AI (source-diff): Bundled web dashboard, no malicious net+exec behavior found. | ai | |
| source-diff | net-exec-file:dist/cli-DuM9yl3u.mjs | AI (source-diff): CLI bundle using standard node builtins for its own runner; no exfil target. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BtR7pjnU.js | AI (source-diff): Bundled dynamic import map for code-split chunks, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BtR7pjnU.js | AI (source-diff): Vite-bundled web dashboard asset, minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/cli-BDpaXglQ.mjs | AI (source-diff): CLI bundle using node child_process/fs for its documented eval-runner functionality. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CJ_Ccv76.js | AI (source-diff): Bundled web app asset; network+exec is normal bundler/runtime code, no malicious target found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CJ_Ccv76.js | AI (source-diff): Vite-bundled web asset with vendor code-splitting map, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-D5dCr6eP.js | AI (source-diff): Bundled web UI asset; no exfil behavior found. | ai | |
| source-diff | net-exec-file:dist/cli-BJAFjIGV.mjs | AI (source-diff): CLI entry using node builtins/child_process for legitimate eval-runner functionality. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-D5dCr6eP.js | AI (source-diff): Vite/Shiki bundled web-app asset, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DXQ_LDQw.js | AI (source-diff): Bundled web asset; network+eval patterns from bundler/runtime, not malicious. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DXQ_LDQw.js | AI (source-diff): Vite-bundled web app asset (shiki language map), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DxZsizjg.js | AI (source-diff): Bundled web asset; no malicious network+exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DxZsizjg.js | AI (source-diff): Vite-bundled web UI asset (mapDeps chunk table), not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-CPBIcMP-.mjs | AI (source-diff): CLI bundle using standard node fs/child_process/crypto imports, not a dropper. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DH0qYD76.js | AI (source-diff): Bundled frontend fetch/module-preload code, benign. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DH0qYD76.js | AI (source-diff): Vite-bundled web app output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-zYAcAPtS.mjs | AI (source-diff): tsdown-bundled module output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-EXO08yya.js | AI (source-diff): Vite/React bundled web asset, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-DumvanQI.mjs | AI (source-diff): CLI git/child_process/fs usage matches package's stated orchestrator function. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BZ1TdyEg.js | AI (source-diff): Vite-bundled web app copied via tsdown config, not obfuscated malicious code. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-XLJByNnS.js | AI (source-diff): Standard bundled web app fetch/module-preload code, not a dropper. | ai | |
| source-diff | net-exec-file:dist/cli-BeJCJMQo.mjs | AI (source-diff): CLI bundle uses declared deps (chokidar, glob, child_process) matching stated function. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-XLJByNnS.js | AI (source-diff): Vite/React bundle artifact, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DKfAipoE.js | AI (source-diff): fetch() calls are Vite's modulepreload polyfill, benign bundle output. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DKfAipoE.js | AI (source-diff): Vite-bundled React web dashboard, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-D9HUAH8K.js | AI (source-diff): Vite-bundled web asset with syntax-highlighter language map, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-D9HUAH8K.js | AI (source-diff): Bundled frontend asset; no credential exfil or fetched-binary execution present. | ai | |
| source-diff | net-exec-file:dist/cli-DbVFgRO3.mjs | AI (source-diff): CLI bundle using node built-ins/child_process/glob for its documented eval-runner function. | ai | |
| source-diff | net-exec-file:dist/cli-BTtgQLjB.mjs | AI (source-diff): CLI orchestrator using child_process/fetch for its own eval-running function, no hostile destination. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-gGumCEnD.js | AI (source-diff): Vite-bundled web dashboard output, not obfuscation; matches documented build/copy config. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BMWBZw_u.js | AI (source-diff): Vite-bundled web asset (Shiki languages list), not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-HBwXIJsg.mjs | AI (source-diff): CLI's own bundled entry using node builtins/child_process for its stated eval-runner function. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BMWBZw_u.js | AI (source-diff): Bundled web UI asset; no malicious network/exec behavior shown. | ai | |
| source-diff | net-exec-file:dist/cli-COzPxKg2.mjs | AI (source-diff): CLI bundle using node fs/child_process for its stated eval-runner purpose. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-COFhQvTJ.mjs | AI (source-diff): tsdown/esbuild bundle of internal orchestration code. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CsSDwFI1.js | AI (source-diff): Vite-bundled web UI asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DrZD98bI.js | AI (source-diff): Vite-bundled web dashboard asset, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DrZD98bI.js | AI (source-diff): Bundled React/Vite app; fetch calls are modulepreload polyfill, no malicious behavior. | ai | |
| source-diff | net-exec-file:dist/cli-ETfZ15RB.mjs | AI (source-diff): CLI bundle uses child_process/fs for its own eval-running function, no external fetch+exec. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DqR1YaMG.js | AI (source-diff): Vite-bundled web app asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-D1edUDhp.mjs | AI (source-diff): tsdown/esbuild bundled runtime, not obfuscated malicious code. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Cosmetic metadata gap, monorepo sub-package. | ai | |
| source-diff | net-exec-file:dist/cli-C0EtHhEO.mjs | AI (source-diff): CLI uses git/child_process for local repo operations, no exfil target. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-AUDD3rNB.js | AI (source-diff): Vite-bundled web asset, minified build output not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CO86PsY-.js | AI (source-diff): Vite-bundled web asset, minified not obfuscated; standard build output. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CO86PsY-.js | AI (source-diff): fetch() calls are Vite's module-preload polyfill, not exfil/exec malware. | ai | |
| source-diff | net-exec-file:dist/cli-BUX6tr9J.mjs | AI (source-diff): CLI bundle uses node:child_process/fs for its own eval-runner functionality, not remote code exec. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-BhUFWvq9.mjs | AI (source-diff): Bundled tsdown/esbuild output with readable source comments; not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CwyTEhGB.js | AI (source-diff): Standard Vite-bundled React app output; minification is expected for a web UI asset in this package. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CwyTEhGB.js | AI (source-diff): Browser fetch + dynamic module loading in a Vite React bundle; not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/cli-CuAAxIuN.mjs | AI (source-diff): Bundled CLI with readable imports and standard Node.js APIs (spawn, fs, crypto); no malicious pattern. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-iwjyQ0DR.js | AI (source-diff): Vite SPA bundle; network+dynamic-import is normal lazy-loading pattern, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-iwjyQ0DR.js | AI (source-diff): Standard Vite-bundled web app asset; long lines are minified syntax-highlighter chunks, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-sWPMWjFJ.js | AI (source-diff): Network calls are fetch() for modulepreload; dynamic code is React runtime. No malicious pattern. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-DoslE_Oo.mjs | AI (source-diff): Bundled but readable TypeScript output with comments; long lines from bundling, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-sWPMWjFJ.js | AI (source-diff): Standard Vite/React production bundle; minified but not obfuscated. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:dist/cli-CVwIjcsX.mjs | AI (source-diff): Readable compiled CLI using Node built-ins (spawn, fs, crypto); no dropper behavior. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-ol64metU.js | AI (source-diff): Frontend bundle uses fetch for modulepreload; no malicious network+exec pattern present. | ai | |
| source-diff | net-exec-file:dist/cli-CG66f0GN.mjs | AI (source-diff): CLI bundle uses Node built-ins (spawn, fetch) for legitimate eval orchestration; readable source with comments. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CYhn4DJ0.mjs | AI (source-diff): Bundled ESM with long lines from minification; readable code with comments, no obfuscation indicators. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-ol64metU.js | AI (source-diff): Vite-bundled React web UI; minified output is expected for this package's embedded web app. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-B3KnzmWT.js | AI (source-diff): Vite-bundled web app asset with __vite__mapDeps; minification is expected for this package's embedded web UI. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-B3KnzmWT.js | AI (source-diff): Network+exec pattern is from Vite's dynamic import/lazy-loading in the bundled web UI, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/cli-Dkp2-rBm.mjs | AI (source-diff): CLI bundle imports chokidar/glob/child_process for legitimate eval orchestration; no exfiltration indicators. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BIEuCK_8.js | AI (source-diff): Vite-bundled frontend asset with syntax highlighter chunks; minification is expected for this web UI dist. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BIEuCK_8.js | AI (source-diff): Standard Vite SPA bundle; network+dynamic-import pattern is normal for lazy-loaded frontend code. | ai | |
| source-diff | net-exec-file:dist/cli-B0QmsWCU.mjs | AI (source-diff): Readable CLI tool for agent eval runner; network+exec usage is legitimate for a test/eval framework CLI. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-ibhQ_P7i.js | AI (source-diff): Standard Vite/React production bundle; minification is expected for a bundled web app asset. | ai | |
| source-diff | net-exec-file:dist/cli-weogme5U.mjs | AI (source-diff): Network calls are LLM API calls; code execution is git/child-process orchestration for eval runner — legitimate tool behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Cba4MFa0.js | AI (source-diff): Standard Vite-bundled React frontend asset; minification is expected for web dist output. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-Cv1kiOAG.mjs | AI (source-diff): tsdown-bundled Node module with readable source region comments; minification is expected build output. | ai | |
| source-diff | net-exec-file:dist/cli-C5FL7C4G.mjs | AI (source-diff): Readable CLI runner that spawns test processes and serves a web UI; network+exec is core to the tool's purpose. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CBvHVkE7.js | AI (source-diff): Standard Vite/React production bundle; minification is expected for this web app asset. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CFF1eYUm.js | AI (source-diff): Standard Vite/React production bundle; minified output is expected for this web UI asset. | ai | |
| source-diff | net-exec-file:dist/cli-CmNNm6d0.mjs | AI (source-diff): CLI tool legitimately uses spawn/spawnSync for subprocess management; no exfiltration or dropper pattern present. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-3bLi3uQJ.js | AI (source-diff): Standard Vite-bundled React app output; package.json explicitly copies web/dist into dist/web via tsdown. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-FEvBwwJI.mjs | AI (source-diff): Minified but readable ESM bundle with clear source-region comments; legitimate orchestration code. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-6YqV9t4k.js | AI (source-diff): Standard Vite-minified React bundle copied from web app build; expected for this package's tsdown config. | ai | |
| source-diff | net-exec-file:dist/cli-Clf8xUFa.mjs | AI (source-diff): CLI tool using spawn/spawnSync for subprocess management and chokidar for file watching; no dropper behavior. | ai | |
| source-diff | net-exec-file:dist/cli-Be0x8CS3.mjs | AI (source-diff): CLI tool using spawnSync('git') and Node fs/path built-ins; no dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-KbbX3NYr.js | AI (source-diff): Standard Vite/React minified bundle; readable JSX/module patterns visible in sample. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-D697g6Qe.mjs | AI (source-diff): Rollup-bundled ESM with readable source comments and standard Node imports; not obfuscated. | ai | |
| source-diff | net-exec-file:dist/cli-BEtk5skO.mjs | AI (source-diff): Bundled CLI using node:child_process (spawn) and node:fs — standard tooling pattern, no suspicious remote execution. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-Bx1VZctJ.js | AI (source-diff): Vite frontend bundle with lazy-loaded language assets; network+exec pattern is normal for SPA chunk loading. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Bx1VZctJ.js | AI (source-diff): Standard Vite-bundled frontend asset; minification is expected for this web app dist output. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BiwYbMem.js | AI (source-diff): Vite-bundled React web UI; minified but not obfuscated. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-C4o5TcIu.mjs | AI (source-diff): Readable TypeScript-compiled ESM with comments; long lines from bundling, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-CwGcJYWe.mjs | AI (source-diff): Readable CLI ESM bundle using standard Node.js APIs; network+exec pattern is legitimate CLI orchestration. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BiwYbMem.js | AI (source-diff): Browser bundle with fetch for modulepreload; no malicious payload. Stable for this package. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BJX1ESNi.js | AI (source-diff): Standard Vite/React minified frontend bundle produced by the documented build script; not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BJX1ESNi.js | AI (source-diff): Network calls and dynamic code in this file are normal browser-side React app patterns (fetch, dynamic imports), not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-dAgwnqH2.js | AI (source-diff): Network+exec pattern is from Vite's dynamic import/lazy-loading mechanism in a bundled web UI, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-dAgwnqH2.js | AI (source-diff): Vite-bundled web app asset with __vite__mapDeps; standard minified frontend output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Cz9p4l-t.js | AI (source-diff): Vite-bundled frontend asset with __vite__mapDeps; minification is expected for this package's embedded web UI. | ai | |
| source-diff | net-exec-file:dist/cli-_g2qOMK6.mjs | AI (source-diff): CLI bundle with readable imports and standard Node APIs (spawn, fs); no obfuscation or suspicious payloads. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-Cz9p4l-t.js | AI (source-diff): Same Vite bundle; network+eval pattern is standard browser SPA code, not dropper malware. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-RNejIyap.js | AI (source-diff): Vite SPA bundle; network calls and dynamic imports are normal browser app patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-RNejIyap.js | AI (source-diff): Standard Vite-bundled frontend asset with __vite__mapDeps; minification is expected for this package's embedded web UI. | ai | |
| source-diff | net-exec-file:dist/cli-3FrKBc9l.mjs | AI (source-diff): CLI entry point using node:child_process (spawn) and node:fs for legitimate eval orchestration; consistent with package purpose. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-C5IRkeUz.js | AI (source-diff): Vite-bundled React frontend asset; minification is expected for this package's web UI component. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-D2okEB3I.mjs | AI (source-diff): tsdown-bundled orchestration module; long lines from bundling, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-CULTt3Xp.mjs | AI (source-diff): Agent eval CLI legitimately uses spawn/network calls to run test orchestration; consistent with package purpose. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Czer_MdN.js | AI (source-diff): Standard Vite/React minified web UI bundle; expected artifact for a package that ships a web frontend. | ai | |
| source-diff | net-exec-file:dist/cli-BQwRbqsL.mjs | AI (source-diff): CLI tool using spawn/spawnSync for eval subprocess management; network+exec pattern is expected for this tool's purpose. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-ClWYWPen.mjs | AI (source-diff): Bundled orchestration logic with readable imports and comments; minified but not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CmY0_D5Z.js | AI (source-diff): Standard Vite/React minified bundle; obfuscation flag is a false positive for bundled web UI assets. | ai | |
| source-diff | net-exec-file:dist/cli-DrPk66xh.mjs | AI (source-diff): CLI tool legitimately uses spawn + network for eval orchestration; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-B31SV_Bq.mjs | AI (source-diff): tsdown-bundled ESM output with readable source comments; not obfuscated, just minified long lines. | ai | |
| source-diff | net-exec-file:dist/cli-C4yumCXE.mjs | AI (source-diff): CLI tool legitimately uses spawn/spawnSync and fs/crypto; consistent with eval-runner orchestration purpose. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BOSo9TXL.js | AI (source-diff): Standard Vite-minified React bundle for embedded web UI; expected build artifact for this package. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CvJmtK1T.js | AI (source-diff): Standard Vite/React minified bundle; React JSX runtime clearly visible in sample. | ai | |
| source-diff | net-exec-file:dist/cli-DQK5W0je.mjs | AI (source-diff): CLI tool legitimately uses spawn for child process execution and network for local hono server; matches package purpose. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CW_Fzr2c.mjs | AI (source-diff): Minified bundle output from tsdown; long lines are normal for bundled ESM. | ai | |
| source-diff | net-exec-file:dist/cli-T6FYE2Bk.mjs | AI (source-diff): spawn/spawnSync usage is expected for a CLI eval runner; not dropper malware. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BxcwUS7V.js | AI (source-diff): Vite-bundled React web UI; minification is expected for this package's embedded web app. | ai | |
| source-diff | net-exec-file:dist/cli-CMiCEQ-3.mjs | AI (source-diff): CLI orchestration code using spawn/chokidar/glob; pattern is stable for this eval-runner package. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-J1yKYGfN.js | AI (source-diff): Standard Vite/React minified bundle; package.json tsdown config explicitly copies web app dist into package. | ai | |
| source-diff | net-exec-file:dist/cli-C-n-Fd4o.mjs | AI (source-diff): Readable bundled CLI source using spawn/chokidar for eval runner; no dropper behavior. | ai | |
| source-diff | net-exec-file:dist/cli-Sg8UdOnm.mjs | AI (source-diff): CLI bundle with legitimate Node.js imports (spawn, fs, crypto); network+exec pattern is expected for an agent eval runner. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-C4v6dWcv.js | AI (source-diff): Vite React bundle; fetch + dynamic code patterns are normal browser app behavior, not malware. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-C4v6dWcv.js | AI (source-diff): Standard Vite-bundled React app output; minification is expected for web UI assets in this package. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CTzVNrDP.mjs | AI (source-diff): Bundled orchestration module with readable source comments and standard imports; long lines from bundling, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BNQnbfi0.js | AI (source-diff): Vite-bundled React web UI; minification is expected for this asset. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BNQnbfi0.js | AI (source-diff): Browser bundle with fetch for modulepreload; not a dropper. | ai | |
| source-diff | net-exec-file:dist/cli-huuJbDNb.mjs | AI (source-diff): Readable compiled CLI code using Node built-ins; no malicious network+exec pattern. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-ZpN7xty_.mjs | AI (source-diff): Bundled orchestration module with readable source comments; long lines from bundling, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BV_DM8fZ.js | AI (source-diff): Browser bundle with fetch for modulepreload; not a dropper. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BV_DM8fZ.js | AI (source-diff): Vite-bundled React web UI; minification is expected for this asset. | ai | |
| source-diff | net-exec-file:dist/cli-DolSsprq.mjs | AI (source-diff): CLI tool legitimately uses spawn for child process management; network+exec pattern is expected for an eval runner. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DJf7Af49.js | AI (source-diff): Standard Vite/React production bundle; minified but not obfuscated. Pattern is stable for this package. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-CPcVyFRP.js | AI (source-diff): Standard Vite/React production bundle; minified but not obfuscated, React runtime clearly visible in sample. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CAyVXPFz.mjs | AI (source-diff): Readable TypeScript-compiled orchestration module; long lines from bundling, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-CMPmuY7W.mjs | AI (source-diff): Readable compiled CLI code with normal Node.js imports; network+exec pattern is legitimate eval orchestration. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-CPcVyFRP.js | AI (source-diff): Browser-side React app bundle; fetch calls are modulepreload polyfill, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/cli-CiFOqMwS.mjs | AI (source-diff): CLI bundle using Node built-ins (spawn, fetch); readable code with no exfiltration indicators. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DEikHy2a.js | AI (source-diff): Standard Vite/React production bundle; minification is expected for the bundled web UI. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-DEikHy2a.js | AI (source-diff): Browser bundle with fetch/modulepreload; network+exec pattern is normal for a React SPA. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CO3Vf0cQ.mjs | AI (source-diff): Bundled orchestration module; long lines from bundling, not obfuscation — readable source visible in sample. | ai | |
| source-diff | net-exec-file:dist/cli-vdJYkEVk.mjs | AI (source-diff): CLI bundle using node:fs, node:crypto, spawn — legitimate CLI tooling, not dropper. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-am2Knit6.js | AI (source-diff): Minified React web app bundle; fetch calls are browser UI, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-am2Knit6.js | AI (source-diff): Standard Vite-minified React bundle; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-BBg_VUH5.mjs | AI (source-diff): Rollup-bundled Node.js orchestration code; readable source with comments, not obfuscated. | ai | |
| source-diff | net-exec-file:dist/cli-3zANEAhG.mjs | AI (source-diff): CLI tool using spawn/spawnSync for subprocess management; expected pattern for an eval-runner CLI. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DS552a3u.js | AI (source-diff): Vite-bundled React web UI; minified but clearly legitimate React/JSX code in sample. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-9hO8NpgZ.js | AI (source-diff): Standard Vite/React production bundle; minified but not obfuscated. Package explicitly copies web app dist in build config. | ai | |
| source-diff | net-exec-file:dist/cli-BmrtjQj_.mjs | AI (source-diff): CLI tool using Node.js spawn/fs APIs for eval orchestration; no dropper behavior visible in sample. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-BDyNrRQT.mjs | AI (source-diff): Readable bundled ESM output from tsdown; long lines are bundled source, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BCr6J8Uj.js | AI (source-diff): Standard Vite/React production bundle; minified output is expected for this web UI asset. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BCr6J8Uj.js | AI (source-diff): Browser-side React bundle; fetch + dynamic patterns are normal React/Vite output, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-CIARrLs6.mjs | AI (source-diff): Bundled orchestration module with readable source; long lines from bundler output, not intentional obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-CIc_gBNM.mjs | AI (source-diff): CLI bundle imports Node stdlib and project modules; network + spawn usage is expected for an agent-eval CLI tool. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-V1TxX8es.mjs | AI (source-diff): Readable commented TypeScript-compiled orchestration module; long lines from bundling, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli-Dg3abrOv.mjs | AI (source-diff): Readable CLI module using node:child_process for spawning eval runners; legitimate tool behavior. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-BYtcGddU.js | AI (source-diff): Browser bundle with fetch for modulepreload; no dropper pattern, normal SPA behavior. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-BYtcGddU.js | AI (source-diff): Standard Vite-bundled React web UI; minified but not obfuscated, stable build artifact. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-5CB9eJZy.js | AI (source-diff): Standard Vite/React production bundle; minification is expected for a bundled web UI asset. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/index-5CB9eJZy.js | AI (source-diff): Browser-side React bundle; fetch calls are normal browser networking, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/cli-Bk5g-bat.mjs | AI (source-diff): Readable CLI bundle with named imports; network+exec pattern is legitimate for an eval orchestration CLI. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-DR2haqvV.js | AI (source-diff): Vite-bundled React web UI; minified but not obfuscated, readable code in sample. Expected artifact for this package. | ai | |
| source-diff | net-exec-file:dist/cli-DRkwWgTj.mjs | AI (source-diff): CLI entry point using node:child_process (spawn) for running eval subprocesses; legitimate use for an agent eval framework CLI tool. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-DB0dwGrd.mjs | AI (source-diff): Rollup-bundled Node.js orchestration code; long lines from bundling, not obfuscation. Readable source with comments in sample. | ai | |
| source-diff | net-exec-file:dist/cli-BEPaYHmX.mjs | AI (source-diff): CLI tool legitimately uses spawn/chokidar/glob for eval orchestration; no dropper pattern in sample. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-DrgpaDaf.mjs | AI (source-diff): Rollup-bundled ESM output with readable source comments; minification is standard build output. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Cx2CvM6a.js | AI (source-diff): Vite-bundled React web UI; minification is expected for this package's built-in web interface. | ai | |
| source-diff | net-exec-file:dist/cli-B-sCTyz8.mjs | AI (source-diff): CLI tool that spawns child processes and uses network; fully readable source, consistent with agent-eval CLI functionality. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-B3fYtpKo.mjs | AI (source-diff): Bundled orchestration code with readable source comments; minification is expected build output. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/blade-D4QpJJKB.js | AI (source-diff): Minified shiki grammar JSON; not obfuscated malware. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Web UI with shiki editor bundled; large file count is expected. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by bundled web app with shiki syntax highlighting assets. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/angular-html-CU67Zn6k.js | AI (source-diff): Minified shiki grammar JSON bundle. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/andromeeda-C4gqWexZ.js | AI (source-diff): Minified shiki theme JSON bundle. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/ada-bCR0ucgS.js | AI (source-diff): Minified shiki grammar JSON bundle. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/actionscript-3-CoDkCxhg.js | AI (source-diff): Minified shiki grammar JSON bundle. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/abap-BdImnpbu.js | AI (source-diff): Minified shiki/TextMate grammar JSON; not malicious obfuscation. | ai | |
| source-diff | net-exec-file:dist/apps/web/dist/assets/blade-D4QpJJKB.js | AI (source-diff): Bundled web app asset (shiki grammar); network+exec pattern is a false positive in this context. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/apex-D8_7TLub.js | AI (source-diff): Minified shiki grammar JSON bundle. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/apache-Pmp26Uib.js | AI (source-diff): Minified shiki grammar JSON bundle. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/angular-ts-BwZT4LLn.js | AI (source-diff): Minified shiki grammar JSON bundle. | ai | |
| source-diff | net-exec-file:dist/cli-lOZdhO2D.mjs | AI (source-diff): CLI tool using spawn for child process management; network+exec pattern is expected for an eval runner CLI. | ai | |
| source-diff | obfuscated-file:dist/runOrchestration-H0pSUl3I.mjs | AI (source-diff): Bundled/minified orchestration module; sample shows readable source-mapped code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/apps/web/dist/assets/index-Drw0IpOd.js | AI (source-diff): Standard Vite/React minified bundle for the package's embedded web UI; not malicious obfuscation. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal scoped package (@ls-stack); missing metadata is expected for private tooling, not a spam/malware indicator. | ai | |
| phantom-deps | phantom-dep:vitest | AI (phantom-deps): vitest is listed as a runtime dep and used in test config; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 51 of 107)
| Version | Deps | Published |
|---|---|---|
| 0.71.5 | 11 / 5 | |
| 0.71.4 | 11 / 5 | |
| 0.71.3 | 11 / 5 | |
| 0.71.2 | 11 / 5 | |
| 0.71.1 | 11 / 5 | |
| 0.71.0 | 11 / 5 | |
| 0.70.0 | 11 / 5 | |
| 0.69.1 | 11 / 5 | |
| 0.69.0 | 11 / 5 | |
| 0.68.0 | 11 / 5 | |
| 0.67.0 | 11 / 5 | |
| 0.66.1 | 11 / 5 | |
| 0.66.0 | 11 / 5 | |
| 0.65.2 | 11 / 5 | |
| 0.65.1 | 11 / 5 | |
| 0.65.0 | 11 / 5 | |
| 0.64.0 | 11 / 5 | |
| 0.63.0 | 11 / 5 | |
| 0.62.0 | 11 / 5 | |
| 0.61.2 | 11 / 5 | |
| 0.61.1 | 11 / 5 | |
| 0.61.0 | 11 / 5 | |
| 0.60.4 | 11 / 5 | |
| 0.60.3 | 11 / 5 | |
| 0.60.2 | 11 / 5 | |
| 0.60.1 | 11 / 5 | |
| 0.60.0 | 11 / 5 | |
| 0.59.2 | 11 / 5 | |
| 0.59.1 | 11 / 5 | |
| 0.59.0 | 11 / 5 | |
| 0.58.5 | 11 / 5 | |
| 0.58.4 | 11 / 5 | |
| 0.58.3 | 11 / 5 | |
| 0.58.2 | 11 / 5 | |
| 0.58.1 | 11 / 5 | |
| 0.58.0 | 11 / 5 | |
| 0.57.0 | 11 / 5 | |
| 0.56.1 | 11 / 5 | |
| 0.56.0 | 11 / 5 | |
| 0.55.2 | 11 / 5 | |
| 0.55.1 | 11 / 5 | |
| 0.55.0 | 11 / 5 | |
| 0.54.0 | 11 / 5 | |
| 0.53.0 | 11 / 5 | |
| 0.52.3 | 11 / 5 | |
| 0.52.2 | 11 / 5 | |
| 0.52.1 | 11 / 5 | |
| 0.52.0 | 11 / 5 | |
| 0.51.0 | 11 / 5 | |
| 0.50.0 | 11 / 5 | |
| 0.47.0 | 11 / 5 |
v0.60.3
4 findings
HIGH
New obfuscated file: dist/apps/web/dist/assets/index-CM6MDNqo.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
HIGH
New file with network + code execution: dist/apps/web/dist/assets/index-CM6MDNqo.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
HIGH
New file with network + code execution: dist/cli-BSVUCUxr.mjs
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.