@mastra/deployer-vercel
A Vercel deployer for Mastra applications.
56
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
abhiaiyersmthomasrase-calcsamnikaiyertylerbarneswardpeet
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/studio/assets/core-BhMmbSvt.js | AI (source-diff): Minified vite bundle (shiki/wasm), not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/livekit-client.esm-CKIgC2IJ.js | AI (source-diff): Minified third-party lib bundle, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-D9a0smyR.js | AI (source-diff): Vite-bundled React app entry, standard minified build output. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-D9a0smyR.js | AI (source-diff): Bundled Studio UI code; network+eval patterns are React/build internals, no malicious destination found. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-DND5bBdQ.js | AI (source-diff): Bundled frontend app code; no concrete malicious network/exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-O7wC8FDm.js | AI (source-diff): Bundled wasm/syntax-highlighter code (Shikiji), not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-DND5bBdQ.js | AI (source-diff): Vite-bundled studio UI (react etc.), minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-avAmkB1u.js | AI (source-diff): Vite/esbuild bundled wasm+shiki asset, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-04biggqk.js | AI (source-diff): Bundled web app code; pattern match on normal fetch/eval-like bundler helpers, no exfil behavior. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-04biggqk.js | AI (source-diff): Vite bundle of React/UI studio app, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-XYsT5xMn.js | AI (source-diff): Bundled Shiki/WASM syntax-highlighter assets, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-DRlaxB9R.js | AI (source-diff): Vite-bundled React/UI app for Studio, minified build output. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-DRlaxB9R.js | AI (source-diff): Bundled frontend app; network+eval patterns are React/Vite internals, not a dropper. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-CkqopPTk.js | AI (source-diff): Bundled React app code; no malicious network/exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-CkqopPTk.js | AI (source-diff): Vite/React bundle for the studio UI, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-DQu3rUGx.js | AI (source-diff): Bundled Shiki/WASM syntax-highlighter output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-x9duW_xn.js | AI (source-diff): Bundled studio UI asset (vite build), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-x9duW_xn.js | AI (source-diff): Bundled UI chunk containing normal fetch+eval patterns from vendored libs, not a dropper. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Known monorepo publisher (mastra-ai) with many legitimately templated sibling packages. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-D0KVfF4J.js | AI (source-diff): Bundled WASM/Shiki syntax-highlighter asset, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-CnSLnmky.js | AI (source-diff): Generic bundled UI code; no concrete malicious network target found. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-CnSLnmky.js | AI (source-diff): Vite-bundled studio UI (React) asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-mNco33Iy.js | AI (source-diff): Vite-bundled studio UI asset (Shiki WASM loader); minification is expected, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-BXZpL7GX.js | AI (source-diff): Vite-bundled React frontend bundle; minification is expected for studio UI assets. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-BXZpL7GX.js | AI (source-diff): Network calls and dynamic module loading are standard Vite lazy-chunk patterns in a React app, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-E7ERv9AI.js | AI (source-diff): Vite-bundled React studio UI; minified frontend bundle, not malware. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-E7ERv9AI.js | AI (source-diff): Network calls and dynamic imports are standard React/Vite lazy-loading patterns in a studio UI bundle. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/python-DhUJRlN_.js | AI (source-diff): Bundled Python TextMate grammar JSON for Shiki; minified data file, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-Cp2Ep0UF.js | AI (source-diff): Vite-bundled Shiki syntax highlighter; minified frontend asset, not malware. | ai | |
| phantom-deps | phantom-dep:easy-day-js | AI (phantom-deps): Declared in package.json but not directly imported; likely injected via config — stable false-positive for phantom-dep rule if dep is legitimate. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-C7US7Gwx.js | AI (source-diff): Vite-bundled studio UI asset; minification is expected for this package's embedded playground. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/mastra-C6UVJT3B-Bn2X4uNg.js | AI (source-diff): Vite-bundled studio UI asset containing React/Shiki; minification is expected. | ai | |
| source-diff | net-exec-file:dist/studio/assets/mastra-C6UVJT3B-Bn2X4uNg.js | AI (source-diff): Network calls and dynamic module loading are standard Vite lazy-loading patterns in a bundled UI, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-VstjICtb.js | AI (source-diff): Vite-bundled Shiki/Oniguruma WASM loader; standard minified frontend asset. | ai | |
| source-diff | net-exec-file:dist/studio/assets/mastra-4G5CNDS4-Cw3EgEyL.js | AI (source-diff): Network+exec pattern fires on bundled React UI code; no dropper behavior present in sample. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/mastra-4G5CNDS4-Cw3EgEyL.js | AI (source-diff): Main Vite bundle for Mastra studio UI (React + deps); minified, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-D19F5dPo.js | AI (source-diff): Vite-bundled Shiki core with WASM loader; standard minified frontend asset. | ai | |
| source-diff | net-exec-file:dist/studio/assets/mastra-ZKR6U5YM-DG6OyiVB.js | AI (source-diff): Network+exec pattern is Vite dynamic import() for code-splitting; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/mastra-ZKR6U5YM-DG6OyiVB.js | AI (source-diff): Vite-bundled React + Mastra studio UI; standard minified frontend bundle. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/engine-compile-BkERmzkH.js | AI (source-diff): Vite-minified regex engine for Shiki; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/core-DMrkGW4y.js | AI (source-diff): Vite-minified Shiki core (WASM loader); standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/bash-atvbtKCR.js | AI (source-diff): Vite-minified shell grammar JSON for Shiki syntax highlighter; not malicious obfuscation. | ai | |
| source-diff | net-exec-file:dist/studio/assets/mastra-VDYWILSO-B9UayzCJ.js | AI (source-diff): Network+exec pattern is React lazy-loading of UI chunks; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/mastra-VDYWILSO-B9UayzCJ.js | AI (source-diff): Vite-bundled React/studio UI; minified but clearly legitimate frontend code. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DNVDGRH6.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | net-exec-file:dist/studio/assets/mastra-ZTYQGPC5-YS_CgMe5.js | AI (source-diff): False positive; network+exec pattern is from minified React/UI code, not dropper malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/mastra-ZTYQGPC5-YS_CgMe5.js | AI (source-diff): Main Mastra studio UI bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-WqEQbxwn.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-wlbdtnyw.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-jxYW895o.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DtgnVmyG.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DQDeBuFn.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dp5bT45W.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Do3MCOqp.js | AI (source-diff): Studio UI asset bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D9zt6Lls.js | AI (source-diff): Lezer Rust parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D69UQMjk.js | AI (source-diff): Lezer PHP parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CyC514KE.js | AI (source-diff): Lezer Java parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CuX2_ynl.js | AI (source-diff): Lezer CSS parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BXsYtI_L.js | AI (source-diff): Lezer Go language parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BpIFu90H.js | AI (source-diff): Lezer SQL parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-5ecfvW2z.js | AI (source-diff): Lezer XML/HTML parser bundle; standard Vite minification. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-0gM2NF40.js | AI (source-diff): Lezer/CodeMirror language grammar bundle; minified by Vite build, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BEkMUKAe.js | AI (source-diff): Vite-minified Lezer grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Bt7FWeVy.js | AI (source-diff): Vite-minified Lezer grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CF0ott0E.js | AI (source-diff): Vite-minified Shiki language map; not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-CbjjImiL.js | AI (source-diff): Vite bundle with fetch + dynamic imports for UI; not a dropper. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-CbjjImiL.js | AI (source-diff): Vite main bundle for studio UI; minification is expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-qajSBKss.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CLd1jyjj.js | AI (source-diff): Vite-minified Lezer grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Cq-1GGqP.js | AI (source-diff): Vite-minified CSS grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CxmKUBmC.js | AI (source-diff): Vite-minified SQL grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DGYKLFP0.js | AI (source-diff): Vite-minified Java grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DJ0xFqTy.js | AI (source-diff): Vite-minified YAML grammar parser; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DJRGlaRq.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dk8FtwwN.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dx1nb-Qd.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-IJJMlwDq.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-lR9r49aF.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-N_GK67CF.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-O0wBkvx7.js | AI (source-diff): Vite-minified studio UI asset; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BkotJFL3.js | AI (source-diff): CodeMirror/Lezer CSS grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-ZileR4Q4.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-tLC25qCj.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-KSBi856v.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dtvw6-un.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DPMYKpZT.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DPGxO1uf.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DlYsjFYf.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DeKPbptu.js | AI (source-diff): Studio UI chunk; standard Vite minified output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DeavA6w-.js | AI (source-diff): Lezer Java grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D2iv1C4J.js | AI (source-diff): Lezer Go grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Crj06nsa.js | AI (source-diff): Lezer HTML/Vue grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Ch17fjP6.js | AI (source-diff): Lezer Jinja/template grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CGoN_KHQ.js | AI (source-diff): Lezer CSS/SCSS grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Bl4NxfJN.js | AI (source-diff): Lezer Python/YAML grammar; standard minified parser table. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CCfyQQnf.js | AI (source-diff): Shiki syntax highlighter lazy-loaded language chunks; standard minified output. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-DXkBZXu3.js | AI (source-diff): Frontend app bundle; network+exec pattern is normal browser UI code, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-DXkBZXu3.js | AI (source-diff): Vite-bundled studio UI; minified frontend bundle, not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-l_gW9ha-.js | AI (source-diff): SPA bundle with fetch + dynamic imports is normal for a React studio UI; not a dropper. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BWEYa6Wd.js | AI (source-diff): Minified CSS language grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-C5SMdEFe.js | AI (source-diff): Minified language grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-C5vFkLuK.js | AI (source-diff): Minified Liquid template grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CE9VBs4g.js | AI (source-diff): Minified PHP grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CQiypF1C.js | AI (source-diff): Minified HTML/XML grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CstG7jfi.js | AI (source-diff): Minified Go grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D51SkQfg.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BggFNwvl.js | AI (source-diff): Minified CodeMirror grammar parser in bundled studio UI; not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Djon9qXR.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DOktXLS1.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Fdm11Ab_.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-FWLFiKw6.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-JR4jl4o8.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-L9uGVUzS.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BRXd0NqA.js | AI (source-diff): Minified Rust language grammar for CodeMirror; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-QbEQSBCz.js | AI (source-diff): Minified studio UI asset; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-l_gW9ha-.js | AI (source-diff): Vite SPA bundle entry point; minification is expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BKRcqDSb.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-B_fpzvFn.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BE_LtRD7.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BM8sRs0O.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BSc7xYEL.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BZtB-nam.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CpsBRHlc.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CrcN8E7A.js | AI (source-diff): Vite-bundled CodeMirror language parser; minified frontend asset, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Cwu056KQ.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DCe74mr1.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DlNMnorP.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DmJXfsVe.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DO0BOWn2.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DXciwm7r.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-gxxBkB1c.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-ZLOw39u3.js | AI (source-diff): Vite-bundled studio UI asset; minified frontend code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-DmJSaA7O.js | AI (source-diff): Main Vite bundle for studio UI; minified frontend code, not malware. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-DmJSaA7O.js | AI (source-diff): Network+exec pattern in bundled frontend UI (React/fetch); not a dropper. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dhg6kAS3.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DGPyX9ya.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dg_THJJw.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D3l9lLXE.js | AI (source-diff): Minified CodeMirror CSS parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D0pTkkLw.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CseSg5yk.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CAhOJ76h.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BVriOCM0.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BV4Fmegt.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BpoMIw8g.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Bm2xYDEl.js | AI (source-diff): Minified CodeMirror language parser; expected bundled UI asset. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-P5XI6kHb.js | AI (source-diff): Frontend bundle for embedded studio UI; network+eval patterns are from bundled React/UI framework code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-P5XI6kHb.js | AI (source-diff): Vite-bundled studio UI; minification is expected for this package's embedded web UI assets. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-v6qxr_LD.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-o5DxNa4w.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-nDt0W1Zw.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-N93jCVoW.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DSjNGVNI.js | AI (source-diff): Minified bundled UI asset; expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-hyiexUSA.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-Da5vWd85.js | AI (source-diff): Vite-bundled studio UI; minified output is expected for this package's embedded playground. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-Da5vWd85.js | AI (source-diff): Network+exec pattern is from bundled React/Vite UI app, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BFPbwhVc.js | AI (source-diff): Lezer/CodeMirror parser grammar bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-bthpR476.js | AI (source-diff): Lezer/CodeMirror SQL parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BWtEmhy2.js | AI (source-diff): Lezer/CodeMirror Handlebars/Mustache parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-C0vFW9pj.js | AI (source-diff): Lezer/CodeMirror Liquid template parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Cbed1unS.js | AI (source-diff): Lezer/CodeMirror Rust parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CepEt0G8.js | AI (source-diff): Lezer/CodeMirror PHP parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-ceufQExa.js | AI (source-diff): Lezer/CodeMirror Vue parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Cl6UcNDm.js | AI (source-diff): Lezer/CodeMirror Go parser bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CnUcrcRK.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Czr-BRha.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Vq29RmsE.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-m9rum56E.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-jCOd2fvg.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-INehCGZv.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DzcWqhqX.js | AI (source-diff): Studio UI asset bundle; minified by design. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BQM0B3Yu.js | AI (source-diff): Vite-bundled Vue template grammar — minified UI asset. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-D5p0mb31.js | AI (source-diff): False positive: network+exec pattern in bundled studio frontend UI, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-D5p0mb31.js | AI (source-diff): Main Vite bundle for studio UI — minified React/framework code, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-qAMgL7a1.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-q5ls1Ctm.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-OfT_DHC3.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DyR-ZHgs.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DybDG8dE.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Dp_SqeRt.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CTgCMrcV.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CezxKApF.js | AI (source-diff): Vite-bundled studio UI asset — minified, not malicious. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CDjxPkI6.js | AI (source-diff): Vite-bundled YAML grammar — minified UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Bt0ZpYCg.js | AI (source-diff): Vite-bundled Jinja/template grammar — minified UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BNbRFtES.js | AI (source-diff): Vite-bundled CSS/SCSS language grammar — minified UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BLcjScJQ.js | AI (source-diff): Vite-bundled Java language grammar — minified UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BKCXdwzN.js | AI (source-diff): Vite-bundled C++ language grammar — minified UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BgnKIsIs.js | AI (source-diff): Vite-bundled Lezer/CodeMirror parser — minified UI asset. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-B2Kjoexn.js | AI (source-diff): Vite-bundled Lezer/CodeMirror parser — minified UI asset, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/blade-a8OxSdnT.js | AI (source-diff): Minified TextMate grammar JSON; not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/studio/assets/blade-a8OxSdnT.js | AI (source-diff): False positive; file is a bundled syntax grammar asset, not a dropper. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 394 new files are shiki/monaco language grammar assets bundled into studio UI; expected for this package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is entirely from bundled studio UI assets (grammars, fonts, themes); expected pattern. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/apex-COJ4H7py.js | AI (source-diff): Minified TextMate grammar JSON; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/apache-Dn00JSTd.js | AI (source-diff): Minified TextMate grammar JSON; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/angular-ts-CKsD7JZE.js | AI (source-diff): Minified TextMate grammar JSON; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/angular-html-LfdN0zeE.js | AI (source-diff): Minified TextMate grammar JSON; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/andromeeda-C3khCPGq.js | AI (source-diff): Minified color theme JSON for syntax highlighting; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/ada-727ZlQH0.js | AI (source-diff): Minified TextMate grammar JSON for syntax highlighting; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/actionscript-3-D_z4Izcz.js | AI (source-diff): Minified TextMate grammar JSON for syntax highlighting; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/abap-DsBKuouk.js | AI (source-diff): Minified TextMate grammar JSON for syntax highlighting; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-CP6EB5Ig.js | AI (source-diff): Main Vite bundle for studio UI; minification expected. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-CP6EB5Ig.js | AI (source-diff): Frontend bundle with fetch+dynamic patterns is normal for a React/Vue studio app; no dropper behavior evident. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-J2K1uPqD.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DU3FtUyc.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DT-bmX_c.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DHBy70un.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DE1Uf-DZ.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-C4t9LjwW.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-C2OqAplM.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-bWOYDAHF.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BUA1uxDU.js | AI (source-diff): Vite-bundled CodeMirror Markdown parser; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Btqfk5yp.js | AI (source-diff): Vite-bundled CodeMirror Angular/Vue template parser; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BRnbZ_zY.js | AI (source-diff): Vite-bundled CodeMirror Liquid template parser; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BcbyRcdO.js | AI (source-diff): Vite-bundled CodeMirror PHP language parser; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-B818jJF8.js | AI (source-diff): Vite-bundled CodeMirror Java language parser; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-B_OqxYGM.js | AI (source-diff): Vite-bundled lezer parser (Vue/HTML); minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-aMP3lwxt.js | AI (source-diff): Vite-bundled CodeMirror C++ language parser; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-0ZhaJMzn.js | AI (source-diff): Vite-bundled CodeMirror/lezer parser; minification is expected for studio UI assets. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-virtual | AI (phantom-deps): @rollup/plugin-virtual is a declared runtime dep loaded by convention in the build pipeline; not a direct import. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from human publisher to GitHub Actions CI is documented by SLSA attestation; stable for this package going forward. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-C3JY-giB.js | AI (source-diff): Main Vite bundle for studio UI; minified frontend app, not malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-xwFYAMf_.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-xQ6MkQZY.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-lVi8ohSV.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-JM8kh28x.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-jLLY5crc.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-i0aoSioD.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DzbjqZuh.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-D0O42cyD.js | AI (source-diff): Minified studio UI bundle; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CE9g4tqB.js | AI (source-diff): Minified CodeMirror SQL language parser bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CAJhefpS.js | AI (source-diff): Minified CodeMirror Python/CoffeeScript language parser bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-C8DbVZr9.js | AI (source-diff): Minified CodeMirror PHP language parser bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BwD1O97j.js | AI (source-diff): Minified CodeMirror Rust language parser bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BRChO8Yu.js | AI (source-diff): Minified CodeMirror C++ language parser bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-BbA95K4k.js | AI (source-diff): Minified CodeMirror Java language parser bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-7ieOcYNR.js | AI (source-diff): Minified Vite/Rollup studio UI bundle; CodeMirror CSS grammar parser, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-8WbdDFad.js | AI (source-diff): Minified CodeMirror XML/HTML language parser bundle; standard build output. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-C3JY-giB.js | AI (source-diff): False positive; bundled frontend app legitimately contains fetch + dynamic patterns from framework code. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DoNqlGSR.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-u6UBUdCT.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/main-DcWjrG5X.js | AI (source-diff): Vite bundle entry point for studio UI; minification expected. | ai | |
| source-diff | net-exec-file:dist/studio/assets/main-DcWjrG5X.js | AI (source-diff): Bundled web app; fetch+dynamic patterns are normal in Vite-built React/editor apps. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DSPApULt.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DQjj8qJ5.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-dYQlj4H8.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DZW0dWfX.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-B2tXr9cL.js | AI (source-diff): Vite-bundled studio UI asset (CodeMirror/lezer grammar); minification is expected for this package. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-B2ZmPe9Q.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Bhl9fxyK.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Cc_Uciz4.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-Cpyw4oZo.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-CSdmUhTv.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DB3pMYNa.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DfK5BMZc.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-DJzSgOaw.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| source-diff | obfuscated-file:dist/studio/assets/index-tOhGp7El.js | AI (source-diff): Vite-bundled studio UI asset; minification expected. | ai | |
| provenance | slsa-provenance | AI (provenance): Published via GitHub Actions with Sigstore attestation; stable supply chain signal for this package. | ai |
Versions (showing 56 of 56)
| Version | Deps | Published |
|---|---|---|
| 1.2.5 | 2 / 12 | |
| 1.2.4 | 2 / 12 | |
| 1.2.3 | 2 / 12 | |
| 1.2.2 | 2 / 12 | |
| 1.2.1 | 2 / 12 | |
| 1.2.0 | 2 / 12 | |
| 1.1.39 | 2 / 12 | |
| 1.1.37 | 2 / 12 | |
| 1.1.36 | 2 / 12 | |
| 1.1.35 | 2 / 12 | |
| 1.1.34 | 2 / 12 | |
| 1.1.33 | 2 / 12 | |
| 1.1.32 | 2 / 12 | |
| 1.1.31 | 2 / 12 | |
| 1.1.30 | 2 / 12 | |
| 1.1.29 | 2 / 12 | |
| 1.1.28 | 2 / 12 | |
| 1.1.27 | 2 / 12 | |
| 1.1.26 | 2 / 12 | |
| 1.1.25 | 2 / 12 | |
| 1.1.24 | 2 / 12 | |
| 1.1.23 | 2 / 12 | |
| 1.1.22 | 2 / 12 | |
| 1.1.21 | 2 / 12 | |
| 1.1.20 | 2 / 12 | |
| 1.1.19 | 2 / 12 | |
| 1.1.18 | 2 / 12 | |
| 1.1.17 | 2 / 12 | |
| 1.1.16 | 2 / 12 | |
| 1.1.15 | 2 / 12 | |
| 1.1.14 | 2 / 12 | |
| 1.1.13 | 2 / 12 | |
| 1.1.12 | 2 / 12 | |
| 1.1.11 | 2 / 12 | |
| 1.1.10 | 2 / 12 | |
| 1.1.9 | 2 / 12 | |
| 1.0.9 | 2 / 11 | |
| 1.0.8 | 2 / 11 | |
| 1.0.7 | 2 / 11 | |
| 1.0.6 | 2 / 11 | |
| 1.0.5 | 2 / 11 | |
| 1.0.4 | 2 / 11 | |
| 1.0.3 | 2 / 11 | |
| 1.0.2 | 2 / 11 | |
| 1.0.1 | 2 / 11 | |
| 1.0.0 | 2 / 11 | |
| 0.12.26 | 3 / 10 | |
| 0.12.25 | 3 / 10 | |
| 0.12.24 | 3 / 10 | |
| 0.12.23 | 3 / 10 | |
| 0.12.22 | 3 / 10 | |
| 0.12.21 | 3 / 10 | |
| 0.12.20 | 3 / 10 | |
| 0.12.19 | 3 / 10 | |
| 0.12.18 | 3 / 10 | |
| 0.12.17 | 3 / 10 |
v1.2.5
5 findings
HIGH
New obfuscated file: dist/studio/assets/core-BhMmbSvt.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/studio/assets/livekit-client.esm-CKIgC2IJ.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/studio/assets/main-D9a0smyR.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
HIGH
New file with network + code execution: dist/studio/assets/main-D9a0smyR.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.4
4 findings
HIGH
New obfuscated file: dist/studio/assets/core-O7wC8FDm.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/studio/assets/main-DND5bBdQ.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
HIGH
New file with network + code execution: dist/studio/assets/main-DND5bBdQ.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.3
4 findings
HIGH
New obfuscated file: dist/studio/assets/core-D0KVfF4J.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/studio/assets/main-CnSLnmky.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/studio/assets/main-CnSLnmky.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.