@nocobase/server
<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>
58
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
chenosjiannlu
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/decompress | AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk. | ai | |
| phantom-deps | phantom-dep:find-package-json | AI (phantom-deps): Standard package discovery utility; indirect usage expected in this framework. | ai | |
| phantom-deps | phantom-dep:@formily/json-schema | AI (phantom-deps): Well-known Alibaba form library; indirect usage expected in NocoBase framework. | ai | |
| phantom-deps | phantom-dep:@types/ini | AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk. | ai | |
| phantom-deps | phantom-dep:@types/multer | AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk. | ai | |
| phantom-deps | phantom-dep:@types/koa-send | AI (phantom-deps): Type declaration package; framework-scoped, no runtime risk. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Standard utility declared in package.json for a large Koa framework; indirect import pattern is expected in monorepo packages. | ai | |
| phantom-deps | phantom-dep:multer | AI (phantom-deps): Standard file-upload middleware declared in package.json; indirect usage pattern expected in this framework. | ai | |
| phantom-deps | phantom-dep:p-queue | AI (phantom-deps): Standard async queue utility; indirect usage expected in large framework package. | ai | |
| phantom-deps | phantom-dep:koa-send | AI (phantom-deps): Standard Koa static file serving utility; indirect usage expected. | ai | |
| phantom-deps | phantom-dep:cronstrue | AI (phantom-deps): Cron description utility consistent with the cron dependency; indirect usage expected. | ai | |
| phantom-deps | phantom-dep:koa-static | AI (phantom-deps): Standard Koa static middleware; indirect usage expected in this framework. | ai | |
| phantom-deps | phantom-dep:@koa/multer | AI (phantom-deps): Standard Koa file upload middleware; indirect usage expected. | ai | |
| phantom-deps | phantom-dep:@koa/router | AI (phantom-deps): Standard Koa router; indirect usage expected in this framework. | ai | |
| phantom-deps | phantom-dep:async-mutex | AI (phantom-deps): Standard async locking utility; indirect usage expected. | ai | |
| phantom-deps | phantom-dep:@nocobase/sdk | AI (phantom-deps): Same-org sibling package; indirect usage expected in NocoBase monorepo. | ai | |
| phantom-deps | phantom-dep:@nocobase/evaluators | AI (phantom-deps): Same-org sibling package; indirect usage expected in NocoBase monorepo. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex encoding/decoding in an AES-256-CBC decryptor is standard cryptographic practice, not payload obfuscation. Stable false positive for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in gateway/index.js is a plugin/module loading pattern for a server framework, not arbitrary code execution from untrusted input. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in a Proxy handler is idiomatic JavaScript for transparent proxy forwarding, not API evasion. Standard pattern in this framework. | ai | |
| bogus-package | bogus-package | AI (bogus-package): NocoBase is a well-known open-source no-code platform. Missing repo/homepage in npm package.json and README formatting are packaging oversights, not spam/malware indicators. | ai | |
| typosquat | typosquat.levenshtein:semver | AI (typosquat): @nocobase/server is a legitimate, long-standing server framework package with 1013 versions. The levenshtein match to 'semver' is a false positive — these are entirely different packages. | ai |
Versions (showing 58 of 159)
| Version | Deps | Published |
|---|---|---|
| 1.9.57 | 48 / 3 | |
| 1.9.56 | 48 / 3 | |
| 1.9.55 | 48 / 3 | |
| 1.9.54 | 48 / 3 | |
| 1.9.53 | 48 / 3 | |
| 1.9.52 | 48 / 3 | |
| 1.9.51 | 48 / 3 | |
| 1.9.49 | 48 / 3 | |
| 1.9.47 | 48 / 3 | |
| 1.9.46 | 48 / 3 | |
| 1.9.45 | 48 / 3 | |
| 1.9.44 | 48 / 3 | |
| 1.9.43 | 48 / 3 | |
| 1.9.42 | 48 / 3 | |
| 1.9.41 | 48 / 3 | |
| 1.9.40 | 48 / 3 | |
| 1.9.39 | 48 / 3 | |
| 1.9.38 | 48 / 3 | |
| 1.9.37 | 48 / 3 | |
| 1.9.36 | 48 / 3 | |
| 1.9.35 | 48 / 3 | |
| 1.9.34 | 48 / 3 | |
| 1.9.33 | 48 / 3 | |
| 1.9.32 | 48 / 3 | |
| 1.9.31 | 48 / 3 | |
| 1.9.30 | 48 / 3 | |
| 1.9.29 | 48 / 3 | |
| 1.9.28 | 48 / 3 | |
| 1.9.27 | 48 / 3 | |
| 1.9.26 | 48 / 3 | |
| 1.9.25 | 48 / 3 | |
| 1.9.24 | 48 / 3 | |
| 1.9.23 | 48 / 3 | |
| 1.9.22 | 48 / 3 | |
| 1.9.21 | 48 / 3 | |
| 1.9.20 | 48 / 3 | |
| 1.9.19 | 48 / 3 | |
| 1.9.18 | 48 / 3 | |
| 1.9.17 | 48 / 3 | |
| 1.9.16 | 48 / 3 | |
| 1.9.15 | 48 / 3 | |
| 1.9.14 | 48 / 3 | |
| 1.9.13 | 48 / 3 | |
| 1.9.12 | 48 / 3 | |
| 1.9.11 | 48 / 3 | |
| 1.9.10 | 48 / 3 | |
| 1.9.9 | 48 / 3 | |
| 1.9.8 | 48 / 3 | |
| 1.9.7 | 48 / 3 | |
| 1.9.6 | 48 / 3 | |
| 1.9.5 | 48 / 3 | |
| 1.9.4 | 48 / 3 | |
| 1.9.3 | 48 / 3 | |
| 1.9.2 | 48 / 3 | |
| 1.9.1 | 48 / 3 | |
| 1.9.0 | 48 / 3 | |
| 1.8.33 | 46 / 3 | |
| 1.8.32 | 46 / 3 |