@nteract/commuter
share, publish, and discover notebooks
1
Versions
BSD-3-Clause
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
emeekscrystalline-catstormpythonwillingcbenabelalexandercboothbenrussertmpacertheengineearyuvipandargbkrklgeigerivanovcaptainsafiapeggyrayzisjdetlehasch
Keywords
nteractjupyters3notebook
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): eval() is in bundled Next.js/webpack output; standard build artifact pattern for this Next.js app. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in minified webpack chunk; standard Next.js bundle pattern. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 is localhost for server-side API routing; not exfiltration. | ai | |
| phantom-deps | phantom-dep:xhr2 | AI (phantom-deps): Runtime dep for browser XHR polyfill in notebook rendering; not directly imported at entry point. | ai | |
| phantom-deps | phantom-dep:canvas | AI (phantom-deps): Runtime dep for server-side canvas rendering; not directly imported at entry point. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Logging dependency used transitively; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:d3-voronoi | AI (phantom-deps): Visualization dep for notebook rendering; not directly imported at entry point. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): HTTP client dep used transitively; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:lodash.merge | AI (phantom-deps): Utility dep used transitively; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-hot-loader | AI (phantom-deps): Dev/runtime dep loaded by Next.js convention; not directly imported. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 5.11.0 | 52 / 1 |