← Home

@oh-my-pi/omp-stats

npm Repository Homepage

Local observability dashboard for pi AI usage statistics

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

can1357

Keywords

aiobservabilitymetricsdashboardllmstatistics

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition from manual publish to CI/CD-attested GitHub Actions; SLSA provenance present — improvement, not compromise. ai
provenance no-provenance AI (provenance): Established publisher with clean track record; lack of Sigstore attestation is low risk here. ai
phantom-deps phantom-dep:@tailwindcss/node AI (phantom-deps): Tailwind node plugin is referenced in build config, not directly imported in source — stable false positive for this package. ai
source-diff obfuscated-file:dist/client/index.js AI (source-diff): Minified React/Tailwind SPA bundle; consistent with dashboard package's declared deps and purpose. ai
phantom-deps phantom-dep:recharts AI (phantom-deps): recharts is a declared runtime dep used in the React dashboard UI; phantom-dep heuristic fires because it's not directly imported at the entry point. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 used to decode embedded client archive for serving dashboard assets, not for executing hidden payloads. ai

Versions (showing 51 of 358)

View all versions
Version Deps Published
16.3.2 11 / 4
16.0.7 11 / 4
15.10.10 10 / 4
15.10.9 10 / 4
15.10.8 10 / 4
15.10.7 10 / 4
15.10.6 10 / 4
15.10.5 10 / 4
15.10.4 10 / 4
15.10.3 10 / 4
15.10.2 10 / 4
15.10.1 10 / 4
15.10.0 10 / 4
15.9.67 10 / 4
15.9.5 10 / 4
15.9.3 10 / 4
15.9.1 10 / 4
15.9.0 10 / 4
15.8.3 10 / 4
15.8.2 10 / 4
15.8.0 10 / 4
15.7.6 10 / 4
15.7.5 10 / 4
15.7.3 10 / 4
15.7.2 10 / 4
15.7.1 10 / 4
15.7.0 10 / 4
15.6.0 10 / 4
15.5.15 10 / 4
15.5.13 10 / 4
15.5.12 10 / 4
15.5.11 10 / 4
15.5.10 10 / 4
15.5.9 10 / 4
15.5.8 10 / 4
15.5.7 10 / 4
15.5.6 10 / 4
15.5.4 10 / 4
15.5.3 10 / 4
15.5.2 10 / 4
15.5.1 10 / 4
15.5.0 10 / 4
15.4.3 10 / 4
15.4.2 10 / 4
15.4.1 10 / 4
15.3.2 10 / 4
15.3.1 10 / 4
15.3.0 10 / 4
15.2.4 10 / 4
15.2.3 10 / 4
15.2.2 10 / 4

v16.3.2

2 findings
HIGH Publisher changed: can1357 → GitHub Actions (on 2026-07-02) provenance

This version was published by a different npm account than previous versions on 2026-07-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.