@niivue/niivue — Greenflagged

minimal webgl2 nifti image viewer

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

thanayik

Keywords

niivuewebgl2niftiimageviewer

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Bundled build output growth from adding legitimate deps, not injected payload.	ai	2026/07/25
dependencies	unvetted-dep:daikon	AI (dependencies): daikon is a DICOM parsing lib appropriate for a medical image viewer.	ai	2026/07/25
source-diff	obfuscated-file:build/index.js	AI (source-diff): tsup/esbuild bundled output, not obfuscation; standard build helper preamble.	ai	2026/07/25
source-diff	encoded-string-file:dist/niivue.umd.js	AI (source-diff): Same WASM base64 blob in UMD build; stable false positive for this package.	ai	2026/05/30
source-diff	encoded-string-file:dist/index.js	AI (source-diff): Encoded strings are WebAssembly binary blobs (blosc codec) embedded as base64 — standard WASM bundling pattern for this package.	ai	2026/05/30
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): Raw IP appears only in a JSDoc comment pointing to a local dev server demo URL, not in runtime code.	ai	2026/04/29
semgrep	semgrep:base64-decode	AI (semgrep): Base64 decoding used for legitimate mesh file format parsing (gzip-compressed binary data in NVMesh loaders).	ai	2026/04/29

Versions (showing 32 of 32)

Version	Deps	Published
0.69.0	7 / 27	2026-05-20
0.68.2	7 / 27	2026-04-17
0.68.1	7 / 27	2026-02-25
0.68.0	7 / 27	2026-02-21
0.67.0	7 / 27	2026-01-12
0.66.0	7 / 26	2025-12-14
0.65.0	7 / 26	2025-11-12
0.42.0	8 / 29	2024-04-23
0.41.1	8 / 30	2024-04-08
0.41.0	8 / 31	2024-03-20
0.40.0	8 / 31	2024-02-29
0.10.1	0 / 13	2021-10-02
0.10.0	0 / 13	2021-10-01
0.9.3	0 / 13	2021-09-30
0.9.2	0 / 13	2021-09-30
0.9.1	0 / 13	2021-09-27
0.9.0	0 / 13	2021-09-27
0.8.3	0 / 13	2021-09-22
0.8.2	0 / 13	2021-09-22
0.8.1	0 / 13	2021-09-17
0.7.0	0 / 13	2021-09-14
0.6.0	0 / 13	2021-09-08
0.5.1	0 / 13	2021-08-20
0.3.0	0 / 13	2021-08-14
0.2.4	0 / 13	2021-08-12
0.2.2	0 / 12	2021-08-10
0.2.1	0 / 12	2021-08-10
0.2.0	0 / 12	2021-08-10
0.1.2	0 / 6	2021-05-07
0.1.1	0 / 6	2021-04-28
0.1.0	0 / 6	2021-04-26
0.0.1	0 / 7	2021-04-25

v0.68.1

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: thanayik → GitHub Actions (on 2026-02-25, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (thanayik) on 2026-02-25, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v0.68.0

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: thanayik → GitHub Actions (on 2026-02-21, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (thanayik) on 2026-02-21, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.