@mondaydotcomorg/atp-server
Server implementation for Agent Tool Protocol
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/index.cjs | AI (source-diff): tsup bundle output, not true obfuscation; matches package's compiler/runtime purpose. | ai | |
| source-diff | net-exec-file:dist/index.cjs | AI (source-diff): Bundled server code legitimately using http + isolated-vm/babel; no exfil behavior shown. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Org-wide maintainer list rotation across monday.com's many approved sibling packages. | ai | |
| phantom-deps | phantom-dep:@types/escodegen | AI (phantom-deps): Type-only package; not imported at runtime by convention. | ai | |
| phantom-deps | phantom-dep:@types/jsonwebtoken | AI (phantom-deps): Type-only package; not imported at runtime by convention. | ai | |
| phantom-deps | phantom-dep:@types/babel__traverse | AI (phantom-deps): Type-only package; not imported at runtime by convention. | ai | |
| phantom-deps | phantom-dep:@types/babel__generator | AI (phantom-deps): Type-only package; not imported at runtime by convention. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/api | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern for server packages. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/core | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used only to test if a string is a JS keyword by attempting to parse `var <name>;` — not arbitrary code execution. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/resources | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/semantic-conventions | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/exporter-trace-otlp-http | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/auto-instrumentations-node | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/exporter-metrics-otlp-http | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| phantom-deps | phantom-dep:rate-limiter-flexible | AI (phantom-deps): Referenced in config files; wildcard version range is a minor concern but stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/sdk-node | AI (phantom-deps): OpenTelemetry packages referenced in config files; standard observability pattern. | ai | |
| phantom-deps | phantom-dep:@types/acorn | AI (phantom-deps): Type-only package; not imported at runtime by convention. | ai | |
| phantom-deps | phantom-dep:@types/js-yaml | AI (phantom-deps): Type-only package; not imported at runtime by convention. | ai |
Versions (showing 41 of 41)
| Version | Deps | Published |
|---|---|---|
| 0.25.0 | 29 / 5 | |
| 0.24.4 | 29 / 5 | |
| 0.24.3 | 29 / 5 | |
| 0.24.2 | 29 / 5 | |
| 0.24.1 | 29 / 5 | |
| 0.24.0 | 29 / 5 | |
| 0.23.0 | 29 / 5 | |
| 0.22.0 | 29 / 5 | |
| 0.21.6 | 29 / 5 | |
| 0.21.5 | 29 / 5 | |
| 0.21.2 | 29 / 5 | |
| 0.21.1 | 29 / 5 | |
| 0.21.0 | 29 / 5 | |
| 0.20.7 | 29 / 5 | |
| 0.20.6 | 29 / 5 | |
| 0.20.5 | 29 / 5 | |
| 0.20.4 | 29 / 5 | |
| 0.20.3 | 29 / 5 | |
| 0.20.2 | 29 / 5 | |
| 0.20.1 | 29 / 5 | |
| 0.20.0 | 29 / 5 | |
| 0.19.17 | 29 / 5 | |
| 0.19.16 | 29 / 5 | |
| 0.19.15 | 29 / 5 | |
| 0.19.14 | 29 / 5 | |
| 0.19.13 | 29 / 5 | |
| 0.19.12 | 30 / 5 | |
| 0.19.11 | 30 / 5 | |
| 0.19.10 | 30 / 5 | |
| 0.19.9 | 30 / 5 | |
| 0.19.8 | 30 / 4 | |
| 0.19.7 | 30 / 4 | |
| 0.19.6 | 30 / 4 | |
| 0.19.5 | 31 / 3 | |
| 0.19.4 | 31 / 3 | |
| 0.19.3 | 31 / 3 | |
| 0.19.2 | 31 / 3 | |
| 0.19.1 | 31 / 3 | |
| 0.18.2 | 30 / 3 | |
| 0.17.16 | 30 / 3 | |
| 0.17.14 | 22 / 8 |
v0.24.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.24.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.24.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.23.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.22.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.21.6
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.21.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.21.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.21.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.21.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.7
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.6
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.17
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.16
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.15
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.14
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.13
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.12
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.11
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.10
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.9
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.