@nocobase/server — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chenosjiannlu

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@types/decompress	AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk.	ai	2026/04/26
phantom-deps	phantom-dep:find-package-json	AI (phantom-deps): Standard package discovery utility; indirect usage expected in this framework.	ai	2026/04/26
phantom-deps	phantom-dep:@formily/json-schema	AI (phantom-deps): Well-known Alibaba form library; indirect usage expected in NocoBase framework.	ai	2026/04/26
phantom-deps	phantom-dep:@types/ini	AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk.	ai	2026/04/26
phantom-deps	phantom-dep:@types/multer	AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk.	ai	2026/04/26
phantom-deps	phantom-dep:@types/koa-send	AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk.	ai	2026/04/26
phantom-deps	phantom-dep:chalk	AI (phantom-deps): Standard utility declared in package.json for a large Koa framework; indirect import pattern is expected in monorepo packages.	ai	2026/04/26
phantom-deps	phantom-dep:multer	AI (phantom-deps): Standard file-upload middleware declared in package.json; indirect usage pattern expected in this framework.	ai	2026/04/26
phantom-deps	phantom-dep:p-queue	AI (phantom-deps): Standard async queue utility; indirect usage expected in large framework package.	ai	2026/04/26
phantom-deps	phantom-dep:koa-send	AI (phantom-deps): Standard Koa static file serving utility; indirect usage expected.	ai	2026/04/26
phantom-deps	phantom-dep:cronstrue	AI (phantom-deps): Cron description utility consistent with the cron dependency; indirect usage expected.	ai	2026/04/26
phantom-deps	phantom-dep:koa-static	AI (phantom-deps): Standard Koa static middleware; indirect usage expected in this framework.	ai	2026/04/26
phantom-deps	phantom-dep:@koa/multer	AI (phantom-deps): Standard Koa file upload middleware; indirect usage expected.	ai	2026/04/26
phantom-deps	phantom-dep:@koa/router	AI (phantom-deps): Standard Koa router; indirect usage expected in this framework.	ai	2026/04/26
phantom-deps	phantom-dep:async-mutex	AI (phantom-deps): Standard async locking utility; indirect usage expected.	ai	2026/04/26
phantom-deps	phantom-dep:@nocobase/sdk	AI (phantom-deps): Same-org sibling package; indirect usage expected in NocoBase monorepo.	ai	2026/04/26
phantom-deps	phantom-dep:@nocobase/evaluators	AI (phantom-deps): Same-org sibling package; indirect usage expected in NocoBase monorepo.	ai	2026/04/26
semgrep	semgrep:hex-decode	AI (semgrep): Hex encoding/decoding in an AES-256-CBC decryptor is standard cryptographic practice, not payload obfuscation. Stable false positive for this package.	ai	2026/04/25
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require in gateway/index.js is a plugin/module loading pattern for a server framework, not arbitrary code execution from untrusted input.	ai	2026/04/25
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get() in a Proxy handler is idiomatic JavaScript for transparent proxy forwarding, not API evasion. Standard pattern in this framework.	ai	2026/04/25
bogus-package	bogus-package	AI (bogus-package): NocoBase is a well-known open-source no-code platform. Missing repo/homepage in npm package.json and README formatting are packaging oversights, not spam/malware indicators.	ai	2026/04/25
typosquat	typosquat.levenshtein:semver	AI (typosquat): @nocobase/server is a legitimate, long-standing server framework package with 1013 versions. The levenshtein match to 'semver' is a false positive — these are entirely different packages.	ai	2026/04/25