@nocobase/plugin-workflow-javascript
Execute a piece of JavaScript in an isolated Node.js environment.
34
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
chenosjiannlu
Keywords
Workflow
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/client/701.b08b27a00a835b5b.js | AI (source-diff): Standard webpack-minified client bundle chunk containing bundled assert polyfill. Normal build artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/client/222.14d8875e2c6f2280.js | AI (source-diff): Standard webpack-minified client bundle chunk with NocoBase copyright header. Minification is expected for frontend plugin builds; not obfuscation. | ai | |
| source-diff | net-exec-file:dist/client/701.b08b27a00a835b5b.js | AI (source-diff): False positive on webpack bundle containing assert polyfill. No actual network+exec attack pattern; patterns come from bundled library code. | ai | |
| source-diff | net-exec-file:dist/node_modules/isolated-vm/isolated-vm.d.ts | AI (source-diff): TypeScript type definitions for the isolated-vm library. Contains API type declarations, not actual network calls or code execution. False positive for this package. | ai | |
| source-diff | net-exec-file:dist/server/IsolatedVm.js | AI (source-diff): This file is the core sandbox worker for the JavaScript workflow node. It uses isolated-vm to run user code in a V8 isolate — the package's stated purpose. Not malware. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): The isolated_vm.node binary is the expected native addon for the isolated-vm package, which is the core dependency for this plugin's sandboxed JS execution feature. Stable for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Part of the established @nocobase scoped ecosystem with 71 versions and 1.6k weekly downloads. Missing repo URL and link-heavy README are hygiene issues, not spam/phishing indicators. | ai |
Versions (showing 34 of 34)
| Version | Deps | Published |
|---|---|---|
| 2.0.62 | 0 / 8 | |
| 2.0.61 | 0 / 8 | |
| 2.0.60 | 0 / 8 | |
| 2.0.59 | 0 / 8 | |
| 2.0.57 | 0 / 8 | |
| 2.0.56 | 0 / 8 | |
| 2.0.55 | 0 / 8 | |
| 2.0.54 | 0 / 8 | |
| 2.0.53 | 0 / 8 | |
| 2.0.52 | 0 / 8 | |
| 2.0.51 | 0 / 8 | |
| 2.0.50 | 0 / 8 | |
| 2.0.49 | 0 / 8 | |
| 2.0.48 | 0 / 8 | |
| 2.0.47 | 0 / 8 | |
| 2.0.46 | 0 / 8 | |
| 2.0.45 | 0 / 8 | |
| 2.0.44 | 0 / 8 | |
| 2.0.43 | 0 / 8 | |
| 2.0.42 | 0 / 8 | |
| 2.0.41 | 0 / 8 | |
| 2.0.40 | 0 / 8 | |
| 2.0.39 | 0 / 8 | |
| 2.0.38 | 0 / 8 | |
| 2.0.37 | 0 / 8 | |
| 2.0.36 | 0 / 8 | |
| 2.0.35 | 0 / 8 | |
| 2.0.34 | 0 / 8 | |
| 2.0.33 | 0 / 8 | |
| 2.0.32 | 0 / 8 | |
| 2.0.31 | 0 / 8 | |
| 2.0.30 | 0 / 8 | |
| 2.0.29 | 0 / 7 | |
| 2.0.28 | 0 / 7 |