@niivue/niivue
minimal webgl2 nifti image viewer
2
Versions
BSD-2-Clause
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
thanayik
Keywords
niivuewebgl2niftiimageviewer
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Encoded strings are WebAssembly binary blobs (blosc codec) embedded as base64 — standard WASM bundling pattern for this package. | ai | |
| source-diff | encoded-string-file:dist/niivue.umd.js | AI (source-diff): Same WASM base64 blob in UMD build; stable false positive for this package. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP appears only in a JSDoc comment pointing to a local dev server demo URL, not in runtime code. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding used for legitimate mesh file format parsing (gzip-compressed binary data in NVMesh loaders). | ai |
v0.69.0
3 findings
HIGH
Long encoded string in modified file: dist/index.js
source-diff
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
HIGH
Long encoded string in modified file: dist/niivue.umd.js
source-diff
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.