@nocobase/plugin-graph-collection-manager

An ER diagram-like tool. Currently only the Master database is supported.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chenosjiannlu

Keywords

Data model tools

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:dist/client/789.273f57644c76961a.js	AI (source-diff): Network calls and dynamic code in webpack client bundle are normal for a frontend graph visualization plugin.	ai	2026/06/01
source-diff	obfuscated-file:dist/client/789.273f57644c76961a.js	AI (source-diff): Standard webpack minified bundle for @antv/x6 graph plugin; minification is expected for this package.	ai	2026/06/01
source-diff	net-exec-file:dist/client/789.f405c48da0d85248.js	AI (source-diff): Network/exec pattern is from x6 graph library bundled code, not dropper malware.	ai	2026/06/01
source-diff	obfuscated-file:dist/client/789.f405c48da0d85248.js	AI (source-diff): Standard webpack minified client bundle for NocoBase plugin; not obfuscation.	ai	2026/06/01
source-diff	obfuscated-file:dist/client/789.f2374d8dd7b6e12a.js	AI (source-diff): Standard webpack-minified frontend bundle for AntV X6 graph plugin; not obfuscated malware.	ai	2026/06/01
source-diff	net-exec-file:dist/client/789.f2374d8dd7b6e12a.js	AI (source-diff): Network calls and dynamic code in a browser webpack chunk are normal for a graph visualization UI library.	ai	2026/06/01
source-diff	net-exec-file:dist/client/789.61a21be91781dacc.js	AI (source-diff): Network calls and dynamic code in a browser webpack chunk are normal for a graph visualization plugin; no dropper behavior evident.	ai	2026/05/31
source-diff	obfuscated-file:dist/client/789.61a21be91781dacc.js	AI (source-diff): Webpack-minified frontend bundle for @antv/x6 graph UI; minification is expected for this package.	ai	2026/05/31
source-diff	net-exec-file:dist/client/789.b9841875b436919f.js	AI (source-diff): Network calls and dynamic code in webpack bundle are from @antv/x6 UI library, not malicious dropper behavior.	ai	2026/05/31
source-diff	obfuscated-file:dist/client/789.b9841875b436919f.js	AI (source-diff): Standard webpack minified bundle for @antv/x6 graph plugin; minification is expected for this package.	ai	2026/05/31
source-diff	net-exec-file:dist/client/789.732240da5594eddb.js	AI (source-diff): Network+exec pattern fires on bundled browser JS (AntV X6); no dropper behavior present in sample.	ai	2026/05/30
source-diff	obfuscated-file:dist/client/789.732240da5594eddb.js	AI (source-diff): Standard webpack minified bundle containing AntV X6 graph library; not obfuscated malware.	ai	2026/05/30
source-diff	obfuscated-file:dist/client/789.5c383836d492774e.js	AI (source-diff): Standard webpack minified bundle containing @antv/x6 minimap code; not obfuscation.	ai	2026/05/30
source-diff	net-exec-file:dist/client/789.5c383836d492774e.js	AI (source-diff): Network calls and dynamic code in a client-side webpack bundle are normal for a graph visualization plugin; no dropper pattern present.	ai	2026/05/30
source-diff	net-exec-file:dist/client/789.edb45c83e486200d.js	AI (source-diff): Network+exec pattern is webpack chunk loading in a browser bundle, not dropper behavior.	ai	2026/05/20
source-diff	obfuscated-file:dist/client/789.edb45c83e486200d.js	AI (source-diff): Standard webpack minified client bundle for @antv/x6 graph plugin; not obfuscated malware.	ai	2026/05/20
source-diff	net-exec-file:dist/client/789.83c7a9ce19d9697b.js	AI (source-diff): False positive; webpack dynamic module loading in a browser bundle, not a dropper/loader.	ai	2026/05/20
source-diff	obfuscated-file:dist/client/789.83c7a9ce19d9697b.js	AI (source-diff): Standard webpack minified bundle containing @antv/x6 graph library; not obfuscated malware.	ai	2026/05/20
source-diff	net-exec-file:dist/client/789.b065e970b78baf91.js	AI (source-diff): Network calls and dynamic code in a browser webpack chunk are normal for a graph visualization library; no dropper behavior evident.	ai	2026/05/20
source-diff	obfuscated-file:dist/client/789.b065e970b78baf91.js	AI (source-diff): Webpack-minified frontend bundle for AntV X6 graph plugin; long lines are expected minification, not obfuscation.	ai	2026/05/20
source-diff	net-exec-file:dist/client/789.4f4326feb331fe58.js	AI (source-diff): Network calls and dynamic code in a browser webpack bundle are normal UI library patterns, not dropper behavior.	ai	2026/05/20
source-diff	obfuscated-file:dist/client/789.4f4326feb331fe58.js	AI (source-diff): Standard webpack minified client bundle (AntV X6 minimap + polyfills); not obfuscated malware.	ai	2026/05/20
source-diff	obfuscated-file:dist/client/67.58db339eaea670e1.js	AI (source-diff): Standard webpack minified client bundle for NocoBase plugin; not obfuscated malware.	ai	2026/05/20
source-diff	net-exec-file:dist/client/789.348566a28a7dc57f.js	AI (source-diff): Browser-side webpack chunk; network calls and dynamic code are normal for a graph UI plugin.	ai	2026/05/18
source-diff	obfuscated-file:dist/client/789.348566a28a7dc57f.js	AI (source-diff): Standard webpack minified bundle for a frontend plugin; not obfuscated malware.	ai	2026/05/18
source-diff	net-exec-file:dist/client/789.9f1dbf23407df175.js	AI (source-diff): Network calls and dynamic code in a browser webpack bundle are standard React/graph-library patterns, not dropper behavior.	ai	2026/05/18
source-diff	obfuscated-file:dist/client/789.9f1dbf23407df175.js	AI (source-diff): Webpack-minified frontend bundle for @antv/x6 graph library; long lines are normal minification output.	ai	2026/05/18
source-diff	net-exec-file:dist/client/789.c123492ef24e79fd.js	AI (source-diff): Webpack chunk with dynamic module loading; not dropper behavior for this client-side graph plugin.	ai	2026/05/18
source-diff	obfuscated-file:dist/client/789.c123492ef24e79fd.js	AI (source-diff): Standard webpack minified bundle for @antv/x6 graph plugin; minification is expected for this package.	ai	2026/05/18
source-diff	obfuscated-file:dist/client/789.71912336f565c3a6.js	AI (source-diff): Standard webpack minified client bundle for AntV X6 graph plugin; minification is expected for this package.	ai	2026/05/01
source-diff	net-exec-file:dist/client/789.71912336f565c3a6.js	AI (source-diff): Browser-side webpack chunk; network+eval patterns are normal for frontend bundles in this NocoBase plugin.	ai	2026/05/01
source-diff	obfuscated-file:dist/client/789.7de884ed13d0ab95.js	AI (source-diff): Webpack-minified frontend bundle for AntV X6 graph plugin; minification is expected for this package.	ai	2026/05/01
source-diff	net-exec-file:dist/client/789.7de884ed13d0ab95.js	AI (source-diff): Network calls and dynamic code in a browser webpack chunk are normal for a graph visualization plugin; no dropper behavior present.	ai	2026/05/01
source-diff	net-exec-file:dist/client/789.576a7d643988136b.js	AI (source-diff): Network+exec pattern is normal for webpack bundles with graph rendering; no dropper indicators in sample.	ai	2026/04/29
source-diff	obfuscated-file:dist/client/789.576a7d643988136b.js	AI (source-diff): Standard webpack minified client bundle for @antv/x6 graph plugin; not obfuscated malware.	ai	2026/04/29
source-diff	net-exec-file:dist/client/254bbf8b68bff1c2.js	AI (source-diff): Browser-side webpack bundle for an ER diagram UI tool; network+exec pattern is a false positive for legitimate frontend bundles using @antv/x6 graph library.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/254bbf8b68bff1c2.js	AI (source-diff): Standard webpack-minified client bundle for a NocoBase UI plugin; NocoBase copyright header and webpack chunk push pattern confirm legitimate build output, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/4b1112444184162e.js	AI (source-diff): Standard webpack bundle for NocoBase graph plugin; long lines are minified @antv/x6 CSS and JS, not malicious obfuscation. NocoBase ships all client code as webpack chunks.	ai	2026/04/27
source-diff	net-exec-file:dist/client/4b1112444184162e.js	AI (source-diff): False positive: webpack dynamic module loading + DOM APIs in a client bundle triggers this rule. No actual fetch+eval dropper pattern present; code is legitimate graph visualization UI.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/407cb180ca28361f.js	AI (source-diff): This is a standard webpack-minified client bundle for a NocoBase frontend plugin. Minification is expected; no actual obfuscation or malicious content present.	ai	2026/04/27
source-diff	net-exec-file:dist/client/407cb180ca28361f.js	AI (source-diff): Network+exec pattern is webpack module loading boilerplate, not dropper/loader malware. Standard for any bundled frontend plugin in the NocoBase ecosystem.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/7062b9dc7a75cb97.js	AI (source-diff): This is a standard webpack-bundled client chunk for the NocoBase graph plugin. Minified output from webpack builds is expected and consistent across all versions of this package.	ai	2026/04/27
source-diff	net-exec-file:dist/client/7062b9dc7a75cb97.js	AI (source-diff): The network+exec pattern is webpack's dynamic module loading, not dropper malware. Content is @antv/x6 CSS/polyfills matching the package's ER diagram purpose.	ai	2026/04/27
source-diff	net-exec-file:dist/client/ca49b00585228eff.js	AI (source-diff): Standard webpack bundle combining network (lazy chunk loading) and dynamic execution patterns. Content matches declared @antv/x6 dependencies; no malicious payload present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/ca49b00585228eff.js	AI (source-diff): Webpack-minified client chunk for a mature NocoBase plugin; minification is expected build output, not obfuscation. NocoBase copyright header and x6 CSS content confirm legitimacy.	ai	2026/04/27
source-diff	net-exec-file:dist/client/e7cd0901cd38f8e0.js	AI (source-diff): Network+exec heuristic fires on webpack-bundled frontend UI code for @antv/x6 graph library. No malicious payload; consistent with a graph collection manager plugin.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/e7cd0901cd38f8e0.js	AI (source-diff): File is a standard webpack bundle for the @antv/x6 graph visualization library. Long lines are minified JS, not obfuscation. Content matches declared devDependencies.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/c0956552735adca1.js	AI (source-diff): Standard webpack minified bundle with content-hash filename. NocoBase copyright header present; content is @antv/x6 CSS and DOM polyfills consistent with declared ER diagram functionality.	ai	2026/04/27
source-diff	net-exec-file:dist/client/c0956552735adca1.js	AI (source-diff): Webpack bundles inherently combine network calls and dynamic module execution. No malicious payload visible; consistent with a legitimate frontend plugin bundle.	ai	2026/04/27
source-diff	net-exec-file:dist/client/5bede40b8a4afb6f.js	AI (source-diff): False positive: webpack module resolution pattern triggers net+exec heuristic; no actual remote code fetching or eval of external content present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/5bede40b8a4afb6f.js	AI (source-diff): Standard webpack-bundled frontend artifact for a React/AntV X6 UI plugin; minification is expected build output, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/5e67444a13448b75.js	AI (source-diff): Standard webpack-minified client bundle for a React/AntV X6 graph plugin. NocoBase copyright header present; content is clearly @antv/x6 minimap and DOM polyfill code.	ai	2026/04/27
source-diff	net-exec-file:dist/client/5e67444a13448b75.js	AI (source-diff): False positive: webpack module loading patterns in a frontend bundle trigger net+exec heuristic. No actual network fetch or eval-based code execution present in the sample.	ai	2026/04/27
source-diff	net-exec-file:dist/client/7a469d37cfd45fc9.js	AI (source-diff): False positive: webpack dynamic module loading pattern in a legitimate @antv/x6 bundle; no actual external network calls or arbitrary code execution present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/7a469d37cfd45fc9.js	AI (source-diff): Standard webpack bundle for @antv/x6 minimap plugin; minification is expected for NocoBase client dist files across all versions.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b883ec1bf611c804.js	AI (source-diff): False positive: webpack module system uses dynamic require() (code execution) and @antv/x6 graph library makes network calls for rendering. This is standard client-side bundle behavior, not dropper/loader malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b883ec1bf611c804.js	AI (source-diff): Standard webpack-minified client bundle for @antv/x6 graph library. NocoBase plugins routinely ship chunked webpack bundles; minification is expected build output, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/91f2c98098b432c0.js	AI (source-diff): Webpack-bundled frontend chunk for NocoBase graph plugin. Minified (not obfuscated) output is standard for this package's build pipeline.	ai	2026/04/27
source-diff	net-exec-file:dist/client/91f2c98098b432c0.js	AI (source-diff): Network calls and module execution in webpack chunks are standard for this React/AntV X6 frontend plugin; no dropper/loader patterns present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/056e36898082e1e4.js	AI (source-diff): Standard webpack-minified client bundle for a React/AntV graph plugin. NocoBase copyright header present; content matches declared devDependencies (@antv/x6). Not obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/056e36898082e1e4.js	AI (source-diff): False positive: webpack module system + HTTP calls in a graph visualization frontend bundle. No dropper/loader behavior; content matches @antv/x6 minimap/graph library code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/44511994e6fb1182.js	AI (source-diff): File is a standard webpack minified client bundle for the NocoBase graph plugin. Long lines are minification artifacts, not obfuscation. Pattern is stable for this package's build output.	ai	2026/04/27
source-diff	net-exec-file:dist/client/44511994e6fb1182.js	AI (source-diff): False positive: the 'network + exec' pattern fires on normal browser DOM/event APIs in a minified webpack bundle. No actual remote code loading or exfiltration present.	ai	2026/04/27
source-diff	net-exec-file:dist/client/6b4b63f050e0c14c.js	AI (source-diff): False positive: webpack module loading patterns in a legitimate graph plugin bundle. No actual dropper/exfiltration behavior present in the sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/6b4b63f050e0c14c.js	AI (source-diff): Standard webpack-bundled client JS for a graph visualization plugin; content matches declared AntV X6 devDependencies. Minification is expected for NocoBase plugin dist files.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b5cf5aa471c9e4b2.js	AI (source-diff): False positive: webpack module loader pattern triggers net+exec heuristic. No actual malicious network calls or dynamic code execution beyond standard module bundling.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b5cf5aa471c9e4b2.js	AI (source-diff): Standard webpack bundle for a frontend graph visualization plugin; minification is expected. Content matches @antv/x6 library code consistent with declared devDependencies.	ai	2026/04/27
source-diff	net-exec-file:dist/client/4f516ffc81a71a5d.js	AI (source-diff): DOM manipulation and network calls in a webpack bundle are normal for a React frontend plugin. No malicious dropper/loader behavior evident in the sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/4f516ffc81a71a5d.js	AI (source-diff): This is a standard webpack chunk bundle for a React/AntV frontend plugin. Minified output is expected for NocoBase client builds; not intentional obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/77d98a14b8694585.js	AI (source-diff): False positive: webpack dynamic module loading triggers net+exec heuristic. Code is legitimate @antv/x6 graph visualization bundle with standard React/DOM patterns.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/77d98a14b8694585.js	AI (source-diff): Standard webpack bundle for NocoBase plugin; minification is expected build output, not malicious obfuscation. Pattern is consistent across all NocoBase plugin packages.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b0fe2d920ed62672.js	AI (source-diff): Standard webpack-minified client bundle for a NocoBase plugin. Contains recognizable AntV X6 graph library code with proper copyright headers. Minification is expected for frontend dist files.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b0fe2d920ed62672.js	AI (source-diff): Network + dynamic code patterns in a webpack bundle for a graph visualization plugin are expected. No malicious payload evident; code is consistent with AntV X6 and React usage.	ai	2026/04/27
source-diff	net-exec-file:dist/client/752b2283c66bb5b0.js	AI (source-diff): Webpack chunk for graph visualization UI; network+exec pattern is webpack module loading infrastructure, not dropper behavior. Content is @antv/x6 minimap CSS and DOM polyfills.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/752b2283c66bb5b0.js	AI (source-diff): Standard webpack-minified client bundle for @antv/x6 minimap plugin; consistent with declared devDependencies and NocoBase's build pipeline. Not obfuscated malware.	ai	2026/04/27
source-diff	net-exec-file:dist/client/ed33fd83e4c74b1e.js	AI (source-diff): Network+exec pattern fires on any webpack bundle with API calls; this is a legitimate React/AntV X6 client plugin bundle with no malicious payload evident.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/ed33fd83e4c74b1e.js	AI (source-diff): File is a standard webpack-minified client bundle for a NocoBase plugin; long lines are minified AntV X6 library code, not obfuscation. Pattern is stable for this package's build output.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/d6628d1b6a540290.js	AI (source-diff): Standard webpack-minified client bundle for a NocoBase plugin. The chunk contains @antv/x6 minimap CSS and DOM polyfills, consistent with declared devDependencies. Not intentional obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/d6628d1b6a540290.js	AI (source-diff): Webpack bundle for a graph visualization plugin (@antv/x6). Network calls and dynamic module patterns are expected in this context; no dropper/loader behavior present in the sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/41cfe1f29fe9224e.js	AI (source-diff): Standard webpack-bundled client chunk for a NocoBase plugin; minification is expected for all dist/client/*.js files in this package.	ai	2026/04/27
source-diff	net-exec-file:dist/client/41cfe1f29fe9224e.js	AI (source-diff): False positive: the file is a webpack bundle with DOM polyfills and AntV X6 CSS injection, not a dropper/loader. No actual network fetch + eval pattern present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/752a9b7941a35be8.js	AI (source-diff): Standard webpack chunk for NocoBase's graph-collection-manager plugin; minification is expected for client dist files in this package.	ai	2026/04/27
source-diff	net-exec-file:dist/client/752a9b7941a35be8.js	AI (source-diff): False positive: file contains AntV X6 graph library code (canvas/SVG rendering) bundled via webpack; no actual dropper/loader behavior present.	ai	2026/04/27
source-diff	net-exec-file:dist/client/e9dd21302f0c3a87.js	AI (source-diff): False positive: bundled AntV X6 frontend library with DOM polyfills and CSS injection. No actual dropper/loader behavior; pattern is typical of bundled UI graph libraries.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/e9dd21302f0c3a87.js	AI (source-diff): Standard webpack-minified client bundle containing AntV X6 graph library code, consistent with package.json devDependencies. Legitimate build artifact.	ai	2026/04/27
source-diff	net-exec-file:dist/client/a6937270fcc969d4.js	AI (source-diff): False positive: webpack frontend bundle naturally combines network calls (API requests) and dynamic module execution (chunk loading). No malicious dropper/loader patterns present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/a6937270fcc969d4.js	AI (source-diff): Standard webpack minified bundle for NocoBase's graph collection manager plugin using AntV X6. Content is consistent with the package's declared dependencies and purpose.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/ebf47a0898fd9b24.js	AI (source-diff): Standard webpack minified bundle chunk for NocoBase plugin; long lines are minified JS/CSS from @antv/x6, not obfuscation. Pattern is consistent across all NocoBase plugin versions.	ai	2026/04/27
source-diff	net-exec-file:dist/client/ebf47a0898fd9b24.js	AI (source-diff): False positive on webpack bundle; dynamic module loading + network library code in a client bundle is not dropper/loader behavior. Content is clearly @antv/x6 graph widget code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/108538fea91089a3.js	AI (source-diff): File is a standard webpack-minified bundle of @antv/x6 graph library assets. Long lines are from minification, not obfuscation. Expected build output for this plugin.	ai	2026/04/27
source-diff	net-exec-file:dist/client/108538fea91089a3.js	AI (source-diff): Network calls and DOM manipulation in this webpack bundle are expected for a client-side graph collection manager using @antv/x6. No malicious payload present.	ai	2026/04/27
source-diff	net-exec-file:dist/client/f2f4d7376a15fcff.js	AI (source-diff): False positive: 'network calls' are webpack module resolution and 'dynamic execution' is webpack runtime boilerplate, not dropper/loader behavior. Content is AntV X6 graph library code matching declared deps.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/f2f4d7376a15fcff.js	AI (source-diff): Standard webpack-bundled client chunk containing AntV X6 CSS/JS, matching declared devDependencies; minification is expected for this package's frontend build.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b1f2184b0eeacba2.js	AI (source-diff): Network+exec pattern is from standard webpack module loading in a browser-side bundle, not dropper/loader malware. Content is clearly AntV X6 graph library code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b1f2184b0eeacba2.js	AI (source-diff): File is standard webpack-minified client bundle for a NocoBase plugin, not obfuscated malware. Copyright header and x6 graph library CSS confirm legitimate content.	ai	2026/04/27
source-diff	net-exec-file:dist/client/8eec04c00b5b23fb.js	AI (source-diff): Network+exec pattern is webpack module loading mechanism in a browser bundle, not dropper malware. Content is @antv/x6 minimap CSS/JS as expected from devDependencies.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/8eec04c00b5b23fb.js	AI (source-diff): Standard webpack-minified client bundle for @antv/x6 graph visualization library. NocoBase copyright header present; content matches devDependencies. Not obfuscated malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/9f6c3b2914f2b18e.js	AI (source-diff): Standard webpack-minified client bundle for a graph visualization plugin; long lines are minification artifacts, not obfuscation. NocoBase copyright header present, content matches AntV X6 dependencies.	ai	2026/04/27
source-diff	net-exec-file:dist/client/9f6c3b2914f2b18e.js	AI (source-diff): Browser-side UI plugin legitimately uses network calls and dynamic DOM APIs; not dropper/loader behavior. Consistent with AntV X6 graph library usage in a NocoBase frontend plugin.	ai	2026/04/27
source-diff	net-exec-file:dist/client/7e9c0aaa06b72e55.js	AI (source-diff): Client-side webpack bundle for a graph visualization plugin legitimately contains network calls and dynamic module execution. No malicious payload visible in content.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/7e9c0aaa06b72e55.js	AI (source-diff): File is a standard webpack minified client bundle for AntV X6 graph visualization. Long lines are minification artifacts, not obfuscation. Pattern is consistent across all NocoBase plugin releases.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/642c912a70d37710.js	AI (source-diff): File is a standard webpack production bundle for a NocoBase frontend plugin. Long lines are minified JS, not obfuscation. Pattern is consistent across all NocoBase plugin versions.	ai	2026/04/27
source-diff	net-exec-file:dist/client/642c912a70d37710.js	AI (source-diff): Webpack bundles inherently contain network calls (chunk loading) and dynamic module evaluation. Sample shows benign DOM polyfills and @antv/x6 CSS — no malicious payload.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b3f2163e811ce9d2.js	AI (source-diff): Webpack bundles inherently combine network (chunk loading) and dynamic execution (module system). Sample shows legitimate AntV X6 CSS/DOM code, no malicious network calls or dropper patterns.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b3f2163e811ce9d2.js	AI (source-diff): Standard webpack minified bundle for NocoBase frontend plugin; content-hash filename is normal for webpack output. Not obfuscation — minification of legitimate AntV X6 graph library code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/0fe3a028940eb427.js	AI (source-diff): Standard webpack bundle for NocoBase graph plugin containing AntV X6 library code. Minification is expected for client-side dist files in this package.	ai	2026/04/27
source-diff	net-exec-file:dist/client/0fe3a028940eb427.js	AI (source-diff): Network and dynamic execution patterns in this webpack bundle are standard module loading mechanics (webpack chunk loading), not dropper/loader behavior. Consistent with AntV X6 graph library bundling.	ai	2026/04/27
source-diff	net-exec-file:dist/client/de3676cf1e3fec40.js	AI (source-diff): Webpack bundle for a graph visualization plugin legitimately contains network calls (graph data) and DOM manipulation. No actual dropper/loader behavior visible in samples.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/de3676cf1e3fec40.js	AI (source-diff): Standard webpack minified client bundle for NocoBase graph plugin; contains x6 library CSS/JS, not malicious obfuscation. Pattern is stable for this package's build output.	ai	2026/04/27
source-diff	net-exec-file:dist/client/d4a04ee5eaaaacb0.js	AI (source-diff): False positive: webpack dynamic module loading triggers net+exec heuristic. No actual malicious network calls or code execution patterns present in the bundle.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/d4a04ee5eaaaacb0.js	AI (source-diff): Standard webpack bundle chunk for a NocoBase frontend plugin; minification is expected. Content matches declared @antv/x6 dependencies and NocoBase copyright headers.	ai	2026/04/27
source-diff	net-exec-file:dist/client/7a38854adc588157.js	AI (source-diff): Network calls and dynamic code in this file are from @antv/x6 graph visualization library bundled via webpack; no malicious dropper pattern present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/7a38854adc588157.js	AI (source-diff): Standard webpack bundle of @antv/x6 graph library; minified long lines are expected for this plugin's client build output.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/9049e8640ab3ae0f.js	AI (source-diff): Standard webpack-bundled client chunk for NocoBase plugin; minification is expected build output, not obfuscation. Content is clearly @antv/x6 + React UI code.	ai	2026/04/27
source-diff	net-exec-file:dist/client/9049e8640ab3ae0f.js	AI (source-diff): False positive: webpack dynamic module resolution triggers net+exec heuristic. No actual network fetch + eval pattern; content is legitimate @antv/x6 UI bundle.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/32e8b5eac23c93d0.js	AI (source-diff): Webpack-bundled client chunk for @antv/x6 graph library; minification is expected build output for NocoBase plugins. NocoBase copyright header present, content matches stated package purpose.	ai	2026/04/27
source-diff	net-exec-file:dist/client/32e8b5eac23c93d0.js	AI (source-diff): False positive on webpack bundle; dynamic module loading and network calls in @antv/x6 client bundle are standard and expected for this graph visualization plugin.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b5d3057aed5f93c6.js	AI (source-diff): Webpack-bundled client chunk for a UI plugin; minification is expected. NocoBase copyright header present, code matches @antv/x6 graph library dependencies declared in package.json.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b5d3057aed5f93c6.js	AI (source-diff): False positive for a frontend UI bundle. Network calls and dynamic patterns are standard in webpack bundles for a graph visualization plugin; no malicious payload observed in samples.	ai	2026/04/27
source-diff	net-exec-file:dist/client/3967f9633ceb7fb4.js	AI (source-diff): False positive on webpack bundle. Network calls and dynamic module loading are standard patterns in bundled UI plugins; no dropper/loader behavior present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/3967f9633ceb7fb4.js	AI (source-diff): Webpack content-hash bundle containing AntV X6 graph library code. Minified build artifact consistent with devDependencies; not obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/d60ec86b615e9e9b.js	AI (source-diff): False positive: webpack bundle's dynamic module loading (require/import) triggers net-exec rule. No actual network fetch + eval pattern present; code is standard React/AntV X6 UI components.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/d60ec86b615e9e9b.js	AI (source-diff): Standard webpack-minified client bundle for a NocoBase frontend plugin. Content matches declared AntV X6 dependencies. Minification is expected for this package type.	ai	2026/04/27
source-diff	net-exec-file:dist/client/67cfba3d3fcc491e.js	AI (source-diff): Client-side webpack bundle for a graph UI plugin legitimately contains network calls (API) and dynamic code patterns. No dropper/loader behavior evident in the sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/67cfba3d3fcc491e.js	AI (source-diff): File is a standard webpack content-hash chunk bundling @antv/x6 graph library. Minified output is expected for NocoBase client dist bundles; not obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/43a54de994794323.js	AI (source-diff): Network+exec pattern is webpack's standard dynamic module loading infrastructure, not malicious dropper behavior. Consistent with AntV X6 graph plugin bundle.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/43a54de994794323.js	AI (source-diff): Webpack-minified bundle for AntV X6 graph library with NocoBase copyright header; minification is expected for this plugin's client dist output.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/bf17b15386a6f670.js	AI (source-diff): NocoBase plugins ship webpack-bundled client chunks as standard build artifacts. The sample confirms legitimate AntV X6 graph library code with NocoBase copyright headers — not malicious obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/bf17b15386a6f670.js	AI (source-diff): Network + dynamic code patterns in a webpack bundle for a graph visualization plugin are expected. Sample shows DOM polyfills and AntV X6 CSS — no dropper/loader behavior present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/600f1d12ef25c83b.js	AI (source-diff): Standard webpack-bundled client JS chunk for a frontend visualization plugin. NocoBase copyright header and recognizable AntV X6 library code confirm legitimate minified build output.	ai	2026/04/27
source-diff	net-exec-file:dist/client/600f1d12ef25c83b.js	AI (source-diff): Network calls and dynamic code execution in a webpack bundle for a graph visualization plugin are expected browser-side behaviors from AntV X6 libraries, not malware indicators.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/7bd4ccd9863aa5c8.js	AI (source-diff): This is a standard webpack-minified bundle for the NocoBase graph collection manager plugin. Long lines are minification artifacts, not obfuscation. Pattern is consistent across all NocoBase plugin releases.	ai	2026/04/27
source-diff	net-exec-file:dist/client/7bd4ccd9863aa5c8.js	AI (source-diff): False positive on webpack bundle. Network calls are for graph data fetching; dynamic execution is webpack's standard module loading. No dropper/loader behavior present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/11d5fe9f6b70574e.js	AI (source-diff): Webpack-bundled client JS for a NocoBase frontend plugin. Minification is expected; content matches AntV X6 graph library used by this ER diagram tool.	ai	2026/04/27
source-diff	net-exec-file:dist/client/11d5fe9f6b70574e.js	AI (source-diff): Frontend SPA bundle; network calls are API requests and dynamic execution is webpack module loading. No malware indicators in sampled code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/89caf4b5ad8a58af.js	AI (source-diff): Standard webpack-minified frontend bundle for a graph visualization plugin; NocoBase copyright header present, content matches @antv/x6 devDependencies. Not malicious obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/89caf4b5ad8a58af.js	AI (source-diff): Network+exec pattern is a false positive in webpack UI bundles; @antv/x6 graph library legitimately uses dynamic patterns. No evidence of malicious network calls or code execution.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/79e85708d84ac835.js	AI (source-diff): Standard webpack minified bundle chunk for NocoBase graph plugin; long lines are minification artifacts, not obfuscation. Pattern is consistent across all NocoBase plugin packages.	ai	2026/04/27
source-diff	net-exec-file:dist/client/79e85708d84ac835.js	AI (source-diff): Client-side webpack bundle; dynamic module loading patterns in webpack chunks are not dropper/loader malware. Content is AntV X6 graph library code matching declared devDependencies.	ai	2026/04/27
source-diff	net-exec-file:dist/client/8dd77e95549569b4.js	AI (source-diff): Webpack bundle legitimately contains dynamic module loading and asset URLs. Sample shows @antv/x6 minimap CSS and DOM polyfills — no dropper/loader behavior.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/8dd77e95549569b4.js	AI (source-diff): File is a standard webpack production bundle for @antv/x6 graph visualization. Minification triggers the rule but no actual obfuscation or malicious code is present.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/9ce1b325d3f85603.js	AI (source-diff): Webpack-minified client bundle for a graph visualization plugin; content matches declared @antv/x6 dependencies. Minification is standard build output for NocoBase plugins.	ai	2026/04/27
source-diff	net-exec-file:dist/client/9ce1b325d3f85603.js	AI (source-diff): Browser-side webpack chunk for a UI plugin; network+exec pattern is a false positive for client-side React/antv bundles. No dropper/loader indicators in the sample.	ai	2026/04/27
source-diff	net-exec-file:dist/client/86edd1e275f048fa.js	AI (source-diff): Webpack chunk for @antv/x6; dynamic module loading and network patterns are inherent to the graph library and webpack runtime, not dropper/loader behavior.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/86edd1e275f048fa.js	AI (source-diff): Standard webpack production bundle for @antv/x6 graph visualization. Long lines are minification artifacts, not obfuscation. Consistent with NocoBase frontend build pattern across all plugin versions.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/31de650181a4007a.js	AI (source-diff): Webpack-minified client bundle for @antv/x6 graph visualization library; NocoBase copyright header present, content consistent with ER diagram plugin purpose.	ai	2026/04/27
source-diff	net-exec-file:dist/client/31de650181a4007a.js	AI (source-diff): Standard webpack bundle combining network calls (data fetching) and module loading patterns; no malicious payload visible; consistent with legitimate NocoBase plugin.	ai	2026/04/27
source-diff	net-exec-file:dist/client/d0a692607a54635a.js	AI (source-diff): Webpack bundle's dynamic module loading patterns trigger this rule as a false positive. No evidence of actual external network calls or eval-based execution in the sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/d0a692607a54635a.js	AI (source-diff): Standard webpack-minified client bundle for NocoBase graph plugin; contains AntV X6 visualization code matching declared devDependencies. Not malicious obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b851e2746983168f.js	AI (source-diff): This is a standard webpack production bundle for the AntV X6 graph library. Minification causing long lines is expected and not indicative of malicious obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b851e2746983168f.js	AI (source-diff): Network + code execution pattern is webpack's standard module loading infrastructure in a frontend bundle, not dropper/loader malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/1f0056c04da64928.js	AI (source-diff): Webpack-minified client bundle for @antv/x6 graph visualization. NocoBase copyright header present; content matches plugin's stated purpose. Standard build artifact.	ai	2026/04/27
source-diff	net-exec-file:dist/client/1f0056c04da64928.js	AI (source-diff): False positive: network+exec pattern in webpack bundle for @antv/x6 graph plugin. Sample shows DOM polyfills and CSS, not dropper behavior. Consistent with plugin's graph visualization purpose.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/60c41c5626da9f18.js	AI (source-diff): Standard webpack minified bundle for NocoBase frontend plugin; contains recognizable AntV X6 CSS/JS and NocoBase copyright header. Not obfuscated malware.	ai	2026/04/27
source-diff	net-exec-file:dist/client/60c41c5626da9f18.js	AI (source-diff): Network+exec pattern is a false positive on webpack bundles; dynamic module loading is standard webpack behavior, not dropper/loader malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/20a4dadb6fe3e76f.js	AI (source-diff): Standard webpack bundle for a NocoBase UI plugin; minified lines are expected build output, not intentional obfuscation. Content matches declared @antv/x6 dependencies.	ai	2026/04/27
source-diff	net-exec-file:dist/client/20a4dadb6fe3e76f.js	AI (source-diff): Webpack client bundle for a graph visualization plugin; network calls + dynamic module loading are normal for this type of UI package, not dropper/loader behavior.	ai	2026/04/27
source-diff	net-exec-file:dist/client/74ef5102367d6982.js	AI (source-diff): Webpack bundles for frontend apps legitimately combine network calls and dynamic module execution. The sample shows AntV X6 graph library code, not dropper/loader malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/74ef5102367d6982.js	AI (source-diff): This is a standard webpack-minified frontend bundle for the @antv/x6 graph library. Minified output routinely exceeds 3000 chars per line; not intentional obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/707e0a490b9a35ac.js	AI (source-diff): This is a standard webpack bundle for the @antv/x6 graph visualization library, consistent with declared devDependencies. Minification is expected for client-side build artifacts in this package.	ai	2026/04/27
source-diff	net-exec-file:dist/client/707e0a490b9a35ac.js	AI (source-diff): Network+exec pattern is a false positive on webpack chunk loading and AntV X6 graph library code. Browser-only bundle with no server-side execution risk.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/4fe510d17a4d7381.js	AI (source-diff): Webpack content-hash-named chunk containing @antv/x6 CSS and DOM polyfills; minified build artifact consistent with declared devDependencies, not obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/4fe510d17a4d7381.js	AI (source-diff): False positive on webpack bundle; dynamic module loading patterns in webpack chunks routinely trigger this rule. No actual dropper/loader behavior visible.	ai	2026/04/27
source-diff	net-exec-file:dist/client/35397d4b6a597ebf.js	AI (source-diff): Webpack bundles for browser plugins routinely contain dynamic module loading patterns; this is not dropper/loader behavior for NocoBase frontend chunks.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/35397d4b6a597ebf.js	AI (source-diff): NocoBase ships webpack-bundled frontend chunks as standard build output; minified long lines are expected and not indicative of malicious obfuscation for this package.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/47bdf270cf04c838.js	AI (source-diff): This is a standard webpack minified bundle for the NocoBase graph collection manager plugin. Long lines are minification artifacts, not obfuscation. Pattern is stable for this package's build output.	ai	2026/04/27
source-diff	net-exec-file:dist/client/47bdf270cf04c838.js	AI (source-diff): Network + exec pattern in a webpack frontend bundle for a graph visualization plugin is expected (dynamic module loading, asset URLs). No dropper/loader behavior present in the sample.	ai	2026/04/27
source-diff	net-exec-file:dist/client/bbc6f0fec67ed83e.js	AI (source-diff): Pattern-match false positive on webpack bundle; dynamic module loading in minified frontend code is not dropper/loader behavior for this package.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/bbc6f0fec67ed83e.js	AI (source-diff): Standard webpack-bundled client chunk for a frontend plugin; minification is expected build output for @nocobase packages, not obfuscation.	ai	2026/04/27
source-diff	net-exec-file:dist/client/94a2169c21a7f8e9.js	AI (source-diff): Network + dynamic execution pattern in a webpack bundle for a frontend graph visualization plugin is expected. No malicious payload visible; content matches AntV X6 widget CSS/JS.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/94a2169c21a7f8e9.js	AI (source-diff): File is a standard webpack-minified client bundle for the AntV X6 graph visualization plugin. Long lines are from minification, not obfuscation. Pattern is consistent across NocoBase plugin releases.	ai	2026/04/27
source-diff	net-exec-file:dist/client/a373343a2bd67071.js	AI (source-diff): False positive on webpack bundle; dynamic requires and URL references are standard in bundled client-side code for this NocoBase plugin.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/a373343a2bd67071.js	AI (source-diff): File is a standard webpack bundle chunk for the NocoBase graph plugin, containing minified (not obfuscated) AntV X6 library code. Expected build artifact for this package.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b73f860887dce271.js	AI (source-diff): This is a standard webpack-minified client bundle for a NocoBase frontend plugin. Minified dist files are expected for all @nocobase/* packages.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b73f860887dce271.js	AI (source-diff): Network calls and dynamic module loading in webpack bundles are normal for frontend plugins. No malicious payload visible; content matches AntV X6 graph library usage.	ai	2026/04/27
source-diff	net-exec-file:dist/client/fbf4ecf96201ca6f.js	AI (source-diff): Network calls and dynamic execution in a webpack client bundle are normal frontend behavior. No malicious payload visible; content matches expected @antv/x6 graph visualization code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/fbf4ecf96201ca6f.js	AI (source-diff): File is a standard webpack minified client bundle for the @antv/x6 graph plugin, not obfuscated malware. NocoBase routinely ships hashed chunk files in dist/client/.	ai	2026/04/27
source-diff	net-exec-file:dist/client/4cf9d159ad9f1924.js	AI (source-diff): Webpack bundle chunks inherently contain dynamic module loading patterns; network calls in a graph visualization UI plugin are expected. No dropper/exfiltration patterns visible in the sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/4cf9d159ad9f1924.js	AI (source-diff): NocoBase ships webpack-bundled frontend chunks; long lines are expected minification artifacts, not obfuscation. File content matches @antv/x6 graph library code consistent with package.json devDependencies.	ai	2026/04/27
source-diff	net-exec-file:dist/client/e386950b62ebc55a.js	AI (source-diff): Webpack bundle structural false positive. Network/exec pattern reflects normal module loading and UI network calls in a graph visualization plugin, not dropper behavior.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/e386950b62ebc55a.js	AI (source-diff): Standard webpack-bundled client chunk for a React/AntV X6 graph plugin. Minified build artifact with NocoBase copyright header; not obfuscated malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b976b439959caa26.js	AI (source-diff): Webpack-minified client bundle for a graph visualization plugin; NocoBase copyright header present, content matches @antv/x6 dependencies. Standard build artifact.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b976b439959caa26.js	AI (source-diff): Pattern-match false positive on webpack bundle; network+exec patterns are webpack's standard async chunk loading mechanism, not dropper behavior.	ai	2026/04/27
source-diff	net-exec-file:dist/client/b57c7ce3488639f3.js	AI (source-diff): Network+exec pattern in webpack bundle is a false positive. @antv/x6 graph library legitimately uses network calls and dynamic patterns; no dropper behavior evident in sample.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/b57c7ce3488639f3.js	AI (source-diff): Minified webpack bundle containing @antv/x6 graph library code with NocoBase copyright header. Standard build artifact for this frontend plugin, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/ffc921a7a730c428.js	AI (source-diff): Minified AntV X6 graph library bundle with NocoBase copyright header. Standard build artifact from bundling @antv/x6 and related plugins listed in devDependencies.	ai	2026/04/27
source-diff	net-exec-file:dist/client/ffc921a7a730c428.js	AI (source-diff): False positive: file contains DOM polyfills and AntV X6 CSS/JS — no malicious network calls or dynamic code execution. Pattern match on bundled frontend library code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/e4c72d8f7b8561a4.js	AI (source-diff): Standard webpack-minified bundle for the graph collection manager plugin UI. Long lines are minification artifacts consistent with the declared build toolchain.	ai	2026/04/27
source-diff	net-exec-file:dist/client/369085505f668efa.js	AI (source-diff): Webpack module loader patterns trigger net-exec rule as false positive. No actual dropper/loader behavior present; content is standard React/AntV X6 UI code.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/369085505f668efa.js	AI (source-diff): Standard webpack-minified bundle containing AntV X6 graph library code. Long lines are from minification, not obfuscation. Content matches declared devDependencies.	ai	2026/04/27
source-diff	obfuscated-file:dist/client/2db3f813d90f8468.js	AI (source-diff): Standard webpack minified bundle for @antv/x6 graph UI; long lines are normal minification output, not obfuscation. NocoBase copyright header present.	ai	2026/04/27
source-diff	net-exec-file:dist/client/2db3f813d90f8468.js	AI (source-diff): Webpack chunk for a graph visualization plugin; dynamic module loading + network calls are expected patterns in antv/x6 bundles, not dropper/loader behavior.	ai	2026/04/27
source-diff	net-exec-file:dist/client/789.c503bf02d174c71a.js	AI (source-diff): False positive: file contains CSS-in-JS strings and DOM polyfills from @antv/x6-plugin-minimap. No actual network fetch + dynamic code execution pattern present.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/789.c503bf02d174c71a.js	AI (source-diff): Standard webpack minified client bundle containing @antv/x6 graph library code; long lines are minification artifacts, not obfuscation.	ai	2026/04/26
source-diff	net-exec-file:dist/client/6212cfc7cc184733.js	AI (source-diff): False positive: webpack bundle for a graph visualization plugin legitimately contains network calls (data fetching) and dynamic code patterns (webpack module system). No dropper/loader behavior present.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/6212cfc7cc184733.js	AI (source-diff): Standard webpack-minified client bundle for NocoBase graph plugin. Long lines are minification, not obfuscation; content is clearly @antv/x6 + React code with NocoBase copyright header.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/ba722cf3fe9f1c01.js	AI (source-diff): Standard webpack production build output for a React+AntV X6 client plugin. Minified bundles are expected for all NocoBase plugin client distributions.	ai	2026/04/26
source-diff	net-exec-file:dist/client/ba722cf3fe9f1c01.js	AI (source-diff): False positive: file contains AntV X6 graph library code and browser polyfills bundled via webpack. No malicious network+exec pattern present.	ai	2026/04/26
source-diff	net-exec-file:dist/client/ea786cf79849ace5.js	AI (source-diff): Pattern match on standard frontend bundle combining fetch/XHR with dynamic rendering; no malicious payload evident in the sample. Consistent with NocoBase's graph collection manager plugin.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/ea786cf79849ace5.js	AI (source-diff): Webpack-minified frontend bundle chunk for @antv/x6 graph visualization; minification is expected for production builds of this NocoBase plugin.	ai	2026/04/26
source-diff	net-exec-file:dist/client/08abc1d024de1991.js	AI (source-diff): AntV X6 graph library legitimately uses DOM manipulation and network calls for SVG/image rendering. No dropper/loader indicators present in the sampled code.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/08abc1d024de1991.js	AI (source-diff): This is a standard webpack-minified client bundle for the NocoBase graph collection manager. Long lines are minified AntV X6 library code, not obfuscation. Pattern is stable for this package's build output.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/ca6a149f2217ca7e.js	AI (source-diff): Standard webpack-minified client bundle containing @antv/x6 library code. Minification is expected for all dist/client/*.js files in this package.	ai	2026/04/26
source-diff	net-exec-file:dist/client/ca6a149f2217ca7e.js	AI (source-diff): Network+exec pattern is webpack module loading and DOM polyfills from @antv/x6 visualization library, not malware. Expected in this plugin's bundled client assets.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/6f5e55bd3193ee35.js	AI (source-diff): Standard webpack-bundled client chunk for a NocoBase frontend plugin; minification is expected. NocoBase copyright header and x6 graph library code confirm legitimacy.	ai	2026/04/26
source-diff	net-exec-file:dist/client/6f5e55bd3193ee35.js	AI (source-diff): False positive: webpack dynamic module loading triggers net+exec heuristic. No actual network exfiltration or dropper behavior present in the sample.	ai	2026/04/26
source-diff	net-exec-file:dist/client/789.861b6de5824c7473.js	AI (source-diff): Network calls and dynamic code in this file are from @antv/x6 UI library (CSS injection, DOM polyfills). No malicious dropper behavior evident in the sample.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/789.861b6de5824c7473.js	AI (source-diff): Webpack-bundled @antv/x6 library chunk; minified but not obfuscated. Consistent with devDependencies listing multiple @antv/x6 plugins.	ai	2026/04/26
source-diff	net-exec-file:dist/client/789.28dd3bd4585083d7.js	AI (source-diff): Network+exec pattern is a false positive: content is @antv/x6 graph library bundle with webpack module system. No dropper/loader behavior present. Stable for this package's bundled frontend assets.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/789.28dd3bd4585083d7.js	AI (source-diff): Standard webpack-minified frontend bundle chunk containing @antv/x6 minimap CSS and polyfills. Long lines are minification artifacts, not obfuscation. Stable pattern for this package.	ai	2026/04/26
source-diff	net-exec-file:dist/client/7f3ef3c6a3e856d8.js	AI (source-diff): Webpack bundles inherently contain both network APIs and dynamic module loading (__webpack_require__). The visible code is CSS/DOM polyfills for @antv/x6, not dropper/loader malware.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/7f3ef3c6a3e856d8.js	AI (source-diff): This is a standard webpack minified bundle for the @antv/x6 graph visualization library. Long lines are expected in webpack chunks; no obfuscation or malicious patterns present.	ai	2026/04/26
source-diff	net-exec-file:dist/client/4757a656d85fb420.js	AI (source-diff): Frontend webpack bundle for an ER diagram tool legitimately combines network calls and dynamic rendering. No dropper/loader behavior present in the sample.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/4757a656d85fb420.js	AI (source-diff): This is a standard webpack-minified client bundle for a graph visualization plugin. Long lines are from minification, not obfuscation. Pattern is consistent across NocoBase plugin releases.	ai	2026/04/26
source-diff	net-exec-file:dist/client/5a4a38f62ca5d3be.js	AI (source-diff): Frontend webpack bundle for graph visualization; network+exec pattern is a false positive for @antv/x6 library code. No malicious payload evident.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/5a4a38f62ca5d3be.js	AI (source-diff): Hash-named webpack chunk bundling @antv/x6 visualization library; minified but not obfuscated. Consistent with package purpose and devDependencies.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/76ca3ecdccfcd90d.js	AI (source-diff): File is a standard webpack-minified frontend bundle for @antv/x6 graph library, consistent with the package's ER diagram functionality. Long lines are minification artifacts, not obfuscation.	ai	2026/04/26
source-diff	net-exec-file:dist/client/76ca3ecdccfcd90d.js	AI (source-diff): Network+exec pattern in webpack bundles is a known false positive. The sample shows legitimate UI component code with no dropper/loader behavior.	ai	2026/04/26
source-diff	net-exec-file:dist/client/e52738b023c9c4c5.js	AI (source-diff): False positive on a client-side webpack bundle. Network calls and dynamic execution are webpack module loading patterns, not dropper/loader behavior.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/e52738b023c9c4c5.js	AI (source-diff): Standard webpack minified client bundle containing AntV X6 graph library code. NocoBase copyright header and package-namespaced chunk global confirm legitimate build output.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/fbeaffbb761c5374.js	AI (source-diff): Standard webpack chunk bundle for AntV X6 graph library. Long lines are minified JS, not obfuscation. NocoBase packages consistently ship minified webpack bundles.	ai	2026/04/26
source-diff	net-exec-file:dist/client/fbeaffbb761c5374.js	AI (source-diff): False positive on webpack bundle. Dynamic module loading patterns in webpack output trigger this rule; content is AntV X6 visualization library, not dropper/loader malware.	ai	2026/04/26
source-diff	net-exec-file:dist/client/442644d2e5e009c3.js	AI (source-diff): Network+exec pattern in webpack bundle is a false positive; visible code is DOM polyfills and CSS injection from @antv/x6, not dropper/loader behavior.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/442644d2e5e009c3.js	AI (source-diff): File is a standard webpack bundle for a frontend plugin; long lines are minified JS/CSS from @antv/x6 dependencies, not obfuscation. Pattern is stable for NocoBase client bundles.	ai	2026/04/26
source-diff	net-exec-file:dist/client/2bc3f23f055a1e6b.js	AI (source-diff): False positive: webpack bundles for frontend plugins inherently combine network calls (API interactions) and module evaluation. No malicious patterns visible in the sample.	ai	2026/04/26
bogus-package	bogus-package	AI (bogus-package): NocoBase plugins use documentation-link READMEs pointing to their docs site; this is a known pattern for the @nocobase ecosystem, not spam.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/80a98cfefc2bb0bf.js	AI (source-diff): Standard webpack-bundled client chunk. Content shows legitimate React/GraphCollectionPane component code consistent with the plugin's ER diagram purpose.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/2bc3f23f055a1e6b.js	AI (source-diff): Standard webpack-bundled client chunk for a frontend graph visualization plugin. NocoBase plugins routinely ship minified webpack output; content matches @antv/x6 graph library code.	ai	2026/04/26
source-diff	net-exec-file:dist/client/502f324dcc9ab0f6.js	AI (source-diff): Network + dynamic execution patterns in this webpack bundle are from @antv/x6 graph visualization library, a declared devDependency. No malicious dropper behavior evident.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/502f324dcc9ab0f6.js	AI (source-diff): This is a standard webpack-minified client bundle for the NocoBase graph collection manager plugin. Long lines are minified @antv/x6 library code, not obfuscation. Expected pattern for this package.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/789.c903a424aab26e89.js	AI (source-diff): Standard webpack-bundled client JS chunk containing @antv/x6 minimap CSS and DOM polyfills. Minification is expected build output; not obfuscation.	ai	2026/04/26
source-diff	net-exec-file:dist/client/789.c903a424aab26e89.js	AI (source-diff): Network+exec pattern is webpack module loading and DOM polyfills (NodeList.forEach, Element.append), not dropper/loader malware. Consistent with @antv/x6 library code.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/67.949eb32f4d4bfa2a.js	AI (source-diff): Standard webpack-bundled client JS chunk for a React/antv-x6 plugin. Minification is expected build output for NocoBase frontend plugins; not obfuscation.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/283405d77a8525a6.js	AI (source-diff): Standard webpack bundle for a frontend graph visualization plugin; minification is expected for NocoBase client dist files. Not obfuscation.	ai	2026/04/26
source-diff	net-exec-file:dist/client/283405d77a8525a6.js	AI (source-diff): Webpack bundle for a UI plugin legitimately contains network calls and dynamic module loading; not dropper/loader behavior.	ai	2026/04/26
source-diff	net-exec-file:dist/client/49c9e3420812f7e7.js	AI (source-diff): Client-side webpack chunk for an ER diagram UI plugin; network calls + dynamic module loading are normal webpack runtime patterns, not dropper behavior.	ai	2026/04/26
source-diff	obfuscated-file:dist/client/49c9e3420812f7e7.js	AI (source-diff): Standard webpack minified bundle for a NocoBase frontend plugin; long lines are expected minification output, not obfuscation. Pattern is stable for this package.	ai	2026/04/26
provenance	no-provenance	AI (provenance): NocoBase packages do not use Sigstore provenance attestation; this is consistent across all versions of this established package.	ai	2026/04/26

Versions (showing 51 of 123)

View all versions

Version	Deps	Published
2.0.60	0 / 17	2026-05-29
2.0.59	0 / 17	2026-05-28
2.0.58	0 / 17	2026-05-28
2.0.57	0 / 17	2026-05-25
2.0.56	0 / 17	2026-05-21
2.0.55	0 / 17	2026-05-18
2.0.54	0 / 17	2026-05-15
2.0.53	0 / 17	2026-05-14
2.0.52	0 / 17	2026-05-13
2.0.51	0 / 17	2026-05-10
2.0.50	0 / 17	2026-05-09
2.0.49	0 / 17	2026-05-06
2.0.48	0 / 17	2026-05-04
2.0.47	0 / 17	2026-05-01
2.0.46	0 / 17	2026-04-28
2.0.45	0 / 17	2026-04-27
2.0.44	0 / 17	2026-04-26
2.0.43	0 / 17	2026-04-24
2.0.42	0 / 17	2026-04-23
2.0.41	0 / 17	2026-04-22
2.0.40	0 / 17	2026-04-20
2.0.39	0 / 17	2026-04-17
2.0.38	0 / 17	2026-04-16
2.0.37	0 / 17	2026-04-14
2.0.36	0 / 17	2026-04-10
2.0.35	0 / 17	2026-04-09
2.0.34	0 / 17	2026-04-08
2.0.33	0 / 17	2026-04-08
2.0.32	0 / 17	2026-04-04
2.0.31	0 / 17	2026-04-01
2.0.30	0 / 17	2026-03-30
2.0.29	0 / 17	2026-03-29
2.0.28	0 / 17	2026-03-27
2.0.27	0 / 17	2026-03-26
2.0.26	0 / 17	2026-03-25
2.0.25	0 / 17	2026-03-23
2.0.24	0 / 17	2026-03-22
2.0.23	0 / 17	2026-03-20
2.0.22	0 / 17	2026-03-20
2.0.21	0 / 17	2026-03-20
2.0.20	0 / 17	2026-03-19
2.0.19	0 / 17	2026-03-17
2.0.18	0 / 17	2026-03-17
2.0.17	0 / 17	2026-03-14
2.0.16	0 / 17	2026-03-12
2.0.15	0 / 17	2026-03-12
2.0.14	0 / 17	2026-03-11
2.0.13	0 / 17	2026-03-10
2.0.12	0 / 17	2026-03-09
2.0.11	0 / 17	2026-03-06
2.0.10	0 / 17	2026-03-03

v2.0.60

3 findings

HIGH New obfuscated file: dist/client/789.f405c48da0d85248.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.f405c48da0d85248.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.59

3 findings

HIGH New obfuscated file: dist/client/789.f2374d8dd7b6e12a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.f2374d8dd7b6e12a.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.58

3 findings

HIGH New obfuscated file: dist/client/789.273f57644c76961a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.273f57644c76961a.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.57

3 findings

HIGH New obfuscated file: dist/client/789.61a21be91781dacc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.61a21be91781dacc.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.56

3 findings

HIGH New obfuscated file: dist/client/789.b9841875b436919f.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.b9841875b436919f.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.55

4 findings

HIGH New obfuscated file: dist/client/67.58db339eaea670e1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.732240da5594eddb.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.732240da5594eddb.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.54

4 findings

HIGH New obfuscated file: dist/client/67.58db339eaea670e1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.5c383836d492774e.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.5c383836d492774e.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.53

4 findings

HIGH New obfuscated file: dist/client/67.58db339eaea670e1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.83c7a9ce19d9697b.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.83c7a9ce19d9697b.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.52

4 findings

HIGH New obfuscated file: dist/client/67.58db339eaea670e1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.4f4326feb331fe58.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.4f4326feb331fe58.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.51

3 findings

HIGH New obfuscated file: dist/client/789.edb45c83e486200d.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.edb45c83e486200d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.50

3 findings

HIGH New obfuscated file: dist/client/789.b065e970b78baf91.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.b065e970b78baf91.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.49

3 findings

HIGH New obfuscated file: dist/client/789.9f1dbf23407df175.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.9f1dbf23407df175.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.48

3 findings

HIGH New obfuscated file: dist/client/789.c123492ef24e79fd.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.c123492ef24e79fd.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.47

3 findings

HIGH New obfuscated file: dist/client/789.348566a28a7dc57f.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.348566a28a7dc57f.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.45

3 findings

HIGH New obfuscated file: dist/client/789.7de884ed13d0ab95.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.7de884ed13d0ab95.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.44

3 findings

HIGH New obfuscated file: dist/client/789.71912336f565c3a6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.71912336f565c3a6.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.43

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.42

4 findings

HIGH New obfuscated file: dist/client/67.949eb32f4d4bfa2a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.861b6de5824c7473.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.861b6de5824c7473.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.41

4 findings

HIGH New obfuscated file: dist/client/67.949eb32f4d4bfa2a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.28dd3bd4585083d7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.28dd3bd4585083d7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.40

4 findings

HIGH New obfuscated file: dist/client/67.949eb32f4d4bfa2a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.c503bf02d174c71a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.c503bf02d174c71a.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.39

4 findings

HIGH New obfuscated file: dist/client/67.949eb32f4d4bfa2a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/789.c903a424aab26e89.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/789.c903a424aab26e89.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.38

3 findings

HIGH New obfuscated file: dist/client/4757a656d85fb420.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/4757a656d85fb420.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.37

3 findings

HIGH New obfuscated file: dist/client/7f3ef3c6a3e856d8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/7f3ef3c6a3e856d8.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.36

3 findings

HIGH New obfuscated file: dist/client/5a4a38f62ca5d3be.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/5a4a38f62ca5d3be.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.35

3 findings

HIGH New obfuscated file: dist/client/76ca3ecdccfcd90d.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/76ca3ecdccfcd90d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.34

3 findings

HIGH New obfuscated file: dist/client/fbeaffbb761c5374.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/fbeaffbb761c5374.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.33

3 findings

HIGH New obfuscated file: dist/client/08abc1d024de1991.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/08abc1d024de1991.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.32

3 findings

HIGH New obfuscated file: dist/client/442644d2e5e009c3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/442644d2e5e009c3.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.31

3 findings

HIGH New obfuscated file: dist/client/ea786cf79849ace5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/ea786cf79849ace5.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.30

3 findings

HIGH New obfuscated file: dist/client/283405d77a8525a6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/283405d77a8525a6.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.29

3 findings

HIGH New obfuscated file: dist/client/502f324dcc9ab0f6.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/502f324dcc9ab0f6.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.28

3 findings

HIGH New obfuscated file: dist/client/49c9e3420812f7e7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/49c9e3420812f7e7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.25

4 findings

HIGH New obfuscated file: dist/client/d0a692607a54635a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/d0a692607a54635a.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.24

4 findings

HIGH New obfuscated file: dist/client/60c41c5626da9f18.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/60c41c5626da9f18.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.23

4 findings

HIGH New obfuscated file: dist/client/b976b439959caa26.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/b976b439959caa26.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.22

4 findings

HIGH New obfuscated file: dist/client/89caf4b5ad8a58af.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/89caf4b5ad8a58af.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.21

4 findings

HIGH New obfuscated file: dist/client/b57c7ce3488639f3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/b57c7ce3488639f3.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.20

4 findings

HIGH New obfuscated file: dist/client/31de650181a4007a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/31de650181a4007a.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.19

4 findings

HIGH New obfuscated file: dist/client/1f0056c04da64928.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/1f0056c04da64928.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.18

4 findings

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/ffc921a7a730c428.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/ffc921a7a730c428.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.17

4 findings

HIGH New obfuscated file: dist/client/20a4dadb6fe3e76f.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/20a4dadb6fe3e76f.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.16

4 findings

HIGH New obfuscated file: dist/client/600f1d12ef25c83b.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/600f1d12ef25c83b.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.15

4 findings

HIGH New obfuscated file: dist/client/d4a04ee5eaaaacb0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/d4a04ee5eaaaacb0.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.14

4 findings

HIGH New obfuscated file: dist/client/bbc6f0fec67ed83e.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/bbc6f0fec67ed83e.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.13

4 findings

HIGH New obfuscated file: dist/client/d60ec86b615e9e9b.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/d60ec86b615e9e9b.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.12

4 findings

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/client/f2f4d7376a15fcff.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/f2f4d7376a15fcff.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.11

4 findings

HIGH New obfuscated file: dist/client/91f2c98098b432c0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/91f2c98098b432c0.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.10

4 findings

HIGH New obfuscated file: dist/client/b883ec1bf611c804.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/client/b883ec1bf611c804.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/client/e4c72d8f7b8561a4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.