@nudmcdgnpm/upyog-ui-module-ads
Advertisement Module
12
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
nudmcdgnpm
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@nudmcdgnpm/digit-ui-react-components | AI (dependencies): Same-namespace replacement for @upyog/digit-ui-react-components; consistent internal migration pattern for this publisher. | ai | |
| phantom-deps | phantom-dep:microbundle-crl | AI (phantom-deps): Build tool declared as dep; used in build scripts, config refs expected. | ai | |
| phantom-deps | phantom-dep:redux-thunk | AI (phantom-deps): Redux-thunk declared as runtime dep; config-file reference pattern. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): React-dom declared as runtime dep; config-file reference pattern. | ai | |
| phantom-deps | phantom-dep:react-redux | AI (phantom-deps): React-redux declared as runtime dep; config-file reference pattern. | ai | |
| phantom-deps | phantom-dep:redux | AI (phantom-deps): Redux declared as runtime dep; phantom-dep fires on config refs, not code imports. | ai | |
| source-diff | net-exec-file:index.modern.js | AI (source-diff): Same as index.js — standard bundled React UI module, not malware. | ai | |
| source-diff | obfuscated-file:index.js | AI (source-diff): Standard Babel/Vite minified React bundle; long lines are normal build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:index.modern.js | AI (source-diff): Standard ESM Vite bundle; readable imports visible in sample confirm legitimate UI module. | ai | |
| source-diff | net-exec-file:index.js | AI (source-diff): Network calls are React data-fetching patterns; dynamic code execution is Babel helpers — no dropper behavior. | ai | |
| source-diff | source-size-tripled | AI (source-diff): First version to ship a pre-built bundle; size jump is expected and explained by bundling. | ai | |
| phantom-deps | phantom-dep:react-table | AI (phantom-deps): Declared as direct dep; phantom-dep heuristic fires on config-level references, not a real missing import. | ai | |
| phantom-deps | phantom-dep:@upyog/digit-ui-libraries | AI (phantom-deps): Declared as direct dep; config-level reference pattern, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-hook-form | AI (phantom-deps): Declared as direct dep; config-level reference pattern, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-i18next | AI (phantom-deps): Declared as direct dep; config-level reference pattern, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:lodash.merge | AI (phantom-deps): Declared as direct dep; config-level reference pattern, stable false positive for this package. | ai |