@nextclaw/companion
21
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
peiiii
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/ui/assets/index-BTYfvO1Y.js | AI (source-diff): Standard Vite/React minified bundle; samples show React internals, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/dist-BcuyDkW0.js | AI (source-diff): Standard Vite-minified bundle; samples show readable NextClaw SDK client code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/dist-ByUrBc3d.js | AI (source-diff): Vite-bundled client SDK output; sample shows readable NextClaw API client code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/index-BOcApIzk.js | AI (source-diff): Vite-bundled React UI bundle; sample shows standard React/module boilerplate, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/index-Du-Z83J8.js | AI (source-diff): Standard Vite/React build bundle; samples show React internals and UI code, no malicious content. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/dist-C4JHqXPr.js | AI (source-diff): Standard Vite-bundled minified output; samples show legitimate NextClaw client SDK code. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/index-Dag-FDss.js | AI (source-diff): Standard Vite minified bundle; code is recognizable React/SDK output, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/ui/assets/dist-DQ3evH7b.js | AI (source-diff): Standard Vite minified bundle; code is recognizable React/SDK output, not obfuscated malware. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreads process.env to pass to Electron child process, immediately sanitizing ELECTRON_RUN_AS_NODE — standard Electron launcher pattern. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP is 127.0.0.1 (localhost) default for a local Electron companion shell — not a remote exfiltration endpoint. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 0.1.21 | 6 / 10 | |
| 0.1.20 | 6 / 10 | |
| 0.1.19 | 6 / 10 | |
| 0.1.18 | 6 / 10 | |
| 0.1.17 | 6 / 10 | |
| 0.1.16 | 6 / 10 | |
| 0.1.15 | 6 / 10 | |
| 0.1.14 | 6 / 10 | |
| 0.1.13 | 6 / 10 | |
| 0.1.12 | 6 / 10 | |
| 0.1.11 | 6 / 10 | |
| 0.1.10 | 6 / 10 | |
| 0.1.9 | 6 / 10 | |
| 0.1.8 | 6 / 10 | |
| 0.1.7 | 6 / 10 | |
| 0.1.6 | 6 / 10 | |
| 0.1.5 | 6 / 10 | |
| 0.1.4 | 6 / 10 | |
| 0.1.3 | 6 / 10 | |
| 0.1.2 | 6 / 10 | |
| 0.1.1 | 6 / 10 |