@midscene/computer-playground
Computer playground for Midscene - PC desktop automation
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:static/static/js/index.d37f99f0.js | AI (source-diff): Standard webpack-minified frontend bundle for a playground UI; source maps included, content is React/UI code. | ai | |
| source-diff | net-exec-file:static/static/js/index.d37f99f0.js | AI (source-diff): Network calls are CDN image URLs for logos; no dropper/loader pattern present in the sampled code. | ai | |
| source-diff | obfuscated-file:static/static/js/index.39404b53.js | AI (source-diff): Standard webpack-minified frontend bundle; sample shows React JSX and midscenejs.com URLs, not malware. | ai | |
| source-diff | net-exec-file:static/static/js/index.39404b53.js | AI (source-diff): Network calls in a browser bundle are expected; sample confirms legitimate UI asset fetching. | ai | |
| source-diff | net-exec-file:static/static/js/index.a5c69909.js | AI (source-diff): Network calls reference midscenejs.com/bytednsdoc CDN assets; dynamic execution is webpack module system, not dropper behavior. | ai | |
| source-diff | obfuscated-file:static/static/js/index.a5c69909.js | AI (source-diff): Standard webpack-minified React app bundle; sample shows midscenejs.com logo and React hooks, no malicious patterns. | ai | |
| source-diff | net-exec-file:static/static/js/index.90459088.js | AI (source-diff): Network calls reference midscenejs.com CDN assets; webpack module loader pattern, not malware. | ai | |
| provenance | publisher-changed | AI (provenance): Changed to GitHub Actions CI with SLSA provenance attestation; consistent with legitimate CI/CD migration for this org. | ai | |
| source-diff | obfuscated-file:static/static/js/index.90459088.js | AI (source-diff): Standard webpack-minified frontend bundle; minification is expected for a static playground app. | ai | |
| source-diff | net-exec-file:static/static/js/index.8a8ab099.js | AI (source-diff): Network calls and dynamic module loading are normal webpack chunk patterns in a browser playground app. | ai | |
| source-diff | obfuscated-file:static/static/js/index.8a8ab099.js | AI (source-diff): Standard webpack bundle for a React SPA; minification is expected for this package. | ai | |
| source-diff | net-exec-file:static/static/js/596.6ba15860.js | AI (source-diff): Network calls and dynamic module loading are normal webpack chunk patterns in a browser playground app. | ai | |
| source-diff | obfuscated-file:static/static/js/596.6ba15860.js | AI (source-diff): Standard webpack bundle for a React SPA; minification is expected for this package. | ai | |
| source-diff | net-exec-file:static/static/js/index.aa03b480.js | AI (source-diff): Network calls and dynamic requires are part of the React/webpack bundle pattern for this playground UI, not dropper behavior. | ai | |
| source-diff | obfuscated-file:static/static/js/index.aa03b480.js | AI (source-diff): Standard webpack-minified frontend bundle for playground UI; source map included; not obfuscation. | ai | |
| source-diff | obfuscated-file:static/static/js/index.1ef42c6b.js | AI (source-diff): Standard webpack-minified React app bundle; sample shows legitimate UI rendering code. | ai | |
| source-diff | obfuscated-file:static/static/js/889.6c79d5ba.js | AI (source-diff): Standard webpack-minified frontend bundle; Ant Design color utilities visible in sample, no malicious patterns. | ai | |
| source-diff | net-exec-file:static/static/js/889.6c79d5ba.js | AI (source-diff): Network calls are to midscenejs.com CDN assets; dynamic code execution is webpack module loading, not dropper behavior. | ai | |
| source-diff | net-exec-file:static/static/js/index.1ef42c6b.js | AI (source-diff): Network calls are to bytednsdoc.com CDN for logo images; webpack module system is not dropper behavior. | ai | |
| source-diff | net-exec-file:static/static/js/index.ff04e564.js | AI (source-diff): Network calls and dynamic requires are normal webpack chunk-loading patterns in a frontend bundle. | ai | |
| source-diff | obfuscated-file:static/static/js/index.ff04e564.js | AI (source-diff): Standard webpack minified bundle for a React UI; not obfuscated malware. | ai | |
| source-diff | net-exec-file:static/static/js/382.1037ee88.js | AI (source-diff): Network calls and dynamic requires are normal webpack chunk-loading patterns in a frontend bundle. | ai | |
| source-diff | obfuscated-file:static/static/js/382.1037ee88.js | AI (source-diff): Standard webpack minified bundle for a React UI; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:static/static/js/index.7e82ded0.js | AI (source-diff): Standard webpack/Rspack minified frontend bundle with source map; not obfuscated malware. | ai | |
| source-diff | net-exec-file:static/static/js/index.7e82ded0.js | AI (source-diff): Network calls and dynamic requires are normal in a bundled React playground app; no dropper pattern present. | ai | |
| phantom-deps | phantom-dep:@midscene/core | AI (phantom-deps): Same-org dep declared in package.json; heuristic false positive for monorepo packages. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): express is a declared runtime dep for the playground server; heuristic false positive. | ai | |
| phantom-deps | phantom-dep:cors | AI (phantom-deps): cors is a declared runtime dep used by the express server; heuristic false positive. | ai | |
| dependencies | unvetted-dep:@midscene/shared | AI (dependencies): Same-org sibling dependency at matching version; consistent with monorepo release pattern for the @midscene ecosystem. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Package has 3.2k weekly downloads and 309 versions; missing metadata is a quality issue, not a security signal, for this established project. | ai | |
| dependencies | unvetted-dep:@midscene/playground | AI (dependencies): Same-org sibling dependency at matching version; consistent with monorepo release pattern for the @midscene ecosystem. | ai | |
| dependencies | unvetted-dep:@midscene/computer | AI (dependencies): Same-org sibling dependency at matching version; consistent with monorepo release pattern for the @midscene ecosystem. | ai | |
| dependencies | unvetted-dep:@midscene/core | AI (dependencies): Same-org sibling dependency at matching version; consistent with monorepo release pattern for the @midscene ecosystem. | ai |
Versions (showing 51 of 51)
| Version | Deps | Published |
|---|---|---|
| 1.8.4 | 7 / 5 | |
| 1.8.3 | 7 / 5 | |
| 1.8.2 | 7 / 5 | |
| 1.8.1 | 7 / 5 | |
| 1.8.0 | 7 / 5 | |
| 1.7.10 | 7 / 5 | |
| 1.7.9 | 7 / 5 | |
| 1.7.7 | 7 / 5 | |
| 1.7.6 | 7 / 5 | |
| 1.7.5 | 7 / 5 | |
| 1.7.4 | 7 / 5 | |
| 1.7.3 | 7 / 5 | |
| 1.7.2 | 7 / 5 | |
| 1.7.1 | 7 / 5 | |
| 1.7.0 | 7 / 5 | |
| 1.6.4 | 7 / 5 | |
| 1.6.3 | 7 / 5 | |
| 1.6.2 | 7 / 5 | |
| 1.6.1 | 7 / 5 | |
| 1.6.0 | 7 / 5 | |
| 1.5.8 | 7 / 5 | |
| 1.5.7 | 7 / 5 | |
| 1.5.6 | 7 / 5 | |
| 1.5.5 | 7 / 5 | |
| 1.5.4 | 7 / 5 | |
| 1.5.3 | 7 / 5 | |
| 1.5.2 | 7 / 5 | |
| 1.5.1 | 7 / 5 | |
| 1.5.0 | 7 / 5 | |
| 1.4.9 | 7 / 5 | |
| 1.4.8 | 7 / 5 | |
| 1.4.7 | 7 / 5 | |
| 1.4.6 | 7 / 5 | |
| 1.4.5 | 7 / 5 | |
| 1.4.4 | 7 / 5 | |
| 1.4.3 | 7 / 5 | |
| 1.4.2 | 7 / 5 | |
| 1.4.1 | 7 / 5 | |
| 1.4.0 | 7 / 5 | |
| 1.3.11 | 7 / 5 | |
| 1.3.10 | 7 / 5 | |
| 1.3.9 | 7 / 5 | |
| 1.3.8 | 7 / 5 | |
| 1.3.7 | 7 / 5 | |
| 1.3.6 | 7 / 5 | |
| 1.3.5 | 7 / 5 | |
| 1.3.4 | 7 / 5 | |
| 1.3.3 | 7 / 5 | |
| 1.3.2 | 7 / 5 | |
| 1.3.1 | 7 / 5 | |
| 1.3.0 | 7 / 5 |
v1.8.4
6 findingsThis version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.8.3
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.2
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.1
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.10
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.9
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.7
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.