@open-formulieren/sdk
[](https://www.npmjs.com/package/@open-formulieren/sdk) [](https://codecov
10
Versions
EUPL-1.2
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
bbtmaykinmedia
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@formio/protected-eval | AI (dependencies): Known formio ecosystem dependency, used as declared. | ai | |
| dependencies | unvetted-dep:@open-formulieren/formiojs | AI (dependencies): Same org scope, documented override dependency. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/formio-init-Cw_YCwCA.js | AI (source-diff): Bundled formio init code, not a dropper. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/sdk-C9SeBnp5.js | AI (source-diff): Bundled network+eval patterns from legit libs (axios/leaflet), no malicious target. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/sdk-C9SeBnp5.js | AI (source-diff): Vite-bundled output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/LeafletMap-BKh9TOkX.js | AI (source-diff): Leaflet map bundle; expected minified output for this SDK. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-DQe_zsCg.js | AI (source-diff): Vite bundle with readable React component code in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-BiINV57e.js | AI (source-diff): Vite bundle; readable React/appointment logic visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/FormStepNewRenderer-y-Xp4CuN.js | AI (source-diff): Vite-bundled form step renderer; readable date-fns logic visible in sample. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/formio-init-C1cY1cf4.js | AI (source-diff): Network calls and dynamic code in formio bundle are expected for a form renderer SDK. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/formio-init-C1cY1cf4.js | AI (source-diff): Vite bundle of formio init code; standard minified output. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/_flatRest-B1PZQFnS.js | AI (source-diff): Standard Vite bundle output; minified lodash/utility code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/File-CxHIhi7Y.js | AI (source-diff): Vite-bundled file upload component with MIME type map; normal minification. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/sdk-DINTkVrc.js | AI (source-diff): Network calls in SDK bundle are core functionality for a form submission SDK. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/sdk-DINTkVrc.js | AI (source-diff): Main SDK bundle; expected large minified output. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/Progress-BjQpZs13.js | AI (source-diff): Vite-bundled progress component; standard minification. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/nl-bqRrJRsP.js | AI (source-diff): Dutch i18n bundle; minified message data. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/en-DsofAZob.js | AI (source-diff): Vite-minified i18n message bundle; content is plaintext English UI strings. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/sdk-DKisFVUE.js | AI (source-diff): Network calls and dynamic code in SDK bundle are expected for a form SDK; not malware indicators. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/sdk-DKisFVUE.js | AI (source-diff): Vite-minified main SDK bundle; expected large minified output. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/Progress-B2akzUIF.js | AI (source-diff): Vite-minified bundle chunk; standard React progress component. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/nl-J6cPC0Ml.js | AI (source-diff): Vite-minified Dutch locale bundle; i18n strings. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/nl-DL-SeHbV.js | AI (source-diff): Vite-minified Dutch locale bundle; i18n strings. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/LeafletMap-VYeHlB-p.js | AI (source-diff): Vite-minified Leaflet map bundle; expected for geo component. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-BYd1W_i1.js | AI (source-diff): Vite-minified bundle chunk; standard React appointment component code. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-btpzALEg.js | AI (source-diff): Vite-minified bundle chunk; standard React component code. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/FormStepNewRenderer-CIOJIub-.js | AI (source-diff): Vite-minified bundle; content is date-fns and form step renderer code. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/formio-init-CiYTZB9V.js | AI (source-diff): Network calls and dynamic eval in formio bundle are expected for form renderer; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/formio-init-CiYTZB9V.js | AI (source-diff): Vite-minified formio bundle chunk; standard form renderer code. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/File-Di_Z4VCf.js | AI (source-diff): Vite-minified bundle; content is MIME-type map and file upload component code. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/_flatRest-DKxiis3N.js | AI (source-diff): Vite-minified bundle chunk; content is standard lodash utility code. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/sdk--QqHR5ZJ.js | AI (source-diff): Same Function('return this') global-detection pattern; standard in bundled libs. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/_flatRest-C9UwvLsX.js | AI (source-diff): Standard Vite-minified bundle output; lodash internals visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/File-qrYkXCdT.js | AI (source-diff): Standard Vite-minified bundle; MIME-type map and formio file component visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/formio-init-DQExW6rb.js | AI (source-diff): Standard Vite-minified formio bundle; recognizable formio/core-js patterns in sample. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/formio-init-DQExW6rb.js | AI (source-diff): Function('return this') is a standard global-detection idiom in bundled libs, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/FormStepNewRenderer-Bwkn11ZG.js | AI (source-diff): Standard Vite-minified bundle; date-fns and form step renderer code visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-BJ9d3jnZ.js | AI (source-diff): Standard Vite-minified bundle; appointment/submission React component code visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-u8oE63dD.js | AI (source-diff): Standard Vite-minified bundle; verification code UI component visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/LeafletMap-D4grt2Yd.js | AI (source-diff): Standard Vite-minified bundle; Leaflet 1.9.4 library code with copyright header visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/nl-BYLuhbua.js | AI (source-diff): Standard Vite-minified bundle; Dutch locale file for this SDK. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/Progress-BzcEHZF3.js | AI (source-diff): Standard Vite-minified bundle output for progress component. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/sdk--QqHR5ZJ.js | AI (source-diff): Main SDK Vite bundle; minification is expected for this package. | ai | |
| phantom-deps | phantom-dep:@open-formulieren/design-tokens | AI (phantom-deps): Same-org dep; bundled into dist output. | ai | |
| phantom-deps | phantom-dep:@open-formulieren/leaflet-tools | AI (phantom-deps): Same-org dep; bundled into dist output. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/_flatRest-B5sSdZ1v.js | AI (source-diff): Standard Vite-minified bundle output; lodash internals visible in sample. | ai | |
| phantom-deps | phantom-dep:@fortawesome/fontawesome-free | AI (phantom-deps): CSS/icon dep loaded via config; not directly imported in JS. | ai | |
| phantom-deps | phantom-dep:@open-formulieren/formiojs | AI (phantom-deps): Same-org formio fork; used via overrides/config, not direct import. | ai | |
| phantom-deps | phantom-dep:leaflet-gesture-handling | AI (phantom-deps): Leaflet plugin loaded at runtime via config; phantom-dep is expected. | ai | |
| phantom-deps | phantom-dep:@formio/protected-eval | AI (phantom-deps): Peer/config-level dep for formio; not directly imported in source. | ai | |
| source-diff | large-new-source-files | AI (source-diff): SDK ships Vite bundle chunks; large number of new files is expected on bundle restructuring. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/sdk-Bref3m-m.js | AI (source-diff): net+exec from bundled fetch calls + polyfill patterns; not malicious. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/sdk-Bref3m-m.js | AI (source-diff): Main SDK bundle; standard Vite minification for this package. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/Progress-rfDr4Lxj.js | AI (source-diff): Vite-bundled React Progress component; expected minified output. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/nl-DAcqDvwj.js | AI (source-diff): Dutch i18n message catalog in minified format. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/nl-Bv7U2COG.js | AI (source-diff): Dutch i18n message catalog in minified format. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/LeafletMap-erN2oWjr.js | AI (source-diff): Leaflet map component bundle; expected minified output. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-DQ31uzL7.js | AI (source-diff): Standard Vite-minified bundle output for this SDK. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/index-61SpUEJw.js | AI (source-diff): Vite bundle entry with dynamic imports; React component code visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/immer-CwDZyRGJ.js | AI (source-diff): Minified immer library; immer-specific symbols clearly visible in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/FormStepNewRenderer-DGZHX322.js | AI (source-diff): Vite-bundled React component; form validation logic visible in sample. | ai | |
| source-diff | net-exec-file:dist/bundles/assets/formio-init-CSKi3yKU.js | AI (source-diff): net+exec pattern is polyfill globalThis detection + bundled fetch; not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/formio-init-CSKi3yKU.js | AI (source-diff): Vite-bundled formio init code; standard polyfill patterns in sample. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/File-UYEnCuWT.js | AI (source-diff): Standard Vite bundle; MIME type map visible in sample, no malicious content. | ai | |
| source-diff | obfuscated-file:dist/bundles/assets/en-DPf9P9Ol.js | AI (source-diff): i18n message catalog in minified format; plaintext strings visible in sample. | ai | |
| phantom-deps | phantom-dep:@date-fns/tz | AI (phantom-deps): Config-file reference only; stable false positive for this SDK package. | ai | |
| phantom-deps | phantom-dep:tinyduration | AI (phantom-deps): Config-file reference only; stable false positive for this SDK package. | ai | |
| phantom-deps | phantom-dep:dompurify | AI (phantom-deps): Config-file reference only; stable false positive for this SDK package. | ai | |
| phantom-deps | phantom-dep:nuqs | AI (phantom-deps): Config-file reference only; stable false positive for this SDK package. | ai | |
| phantom-deps | phantom-dep:@utrecht/table-css | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@floating-ui/react | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:react-formio | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:@sentry/react | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:react-select | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:react-leaflet | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:fast-deep-equal | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:immer | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:clsx | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:leaflet | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:date-fns | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:flatpickr | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:ibantools | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:use-immer | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:leaflet-draw | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:proj4leaflet | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:react-number-format | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:zod-formik-adapter | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:react-leaflet-draw | AI (phantom-deps): SDK bundle pattern; deps declared for consumers, not directly imported in source. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 3.5.4 | 38 / 86 | |
| 3.5.3 | 38 / 86 | |
| 3.5.2 | 38 / 86 | |
| 3.5.1 | 38 / 86 | |
| 3.5.0 | 38 / 86 | |
| 3.4.5 | 34 / 83 | |
| 3.4.4 | 34 / 83 | |
| 3.4.3 | 34 / 83 | |
| 3.4.2 | 34 / 83 | |
| 3.4.0 | 34 / 83 |
v3.4.5
13 findings
HIGH
New obfuscated file: dist/bundles/assets/File-Du46Dsjb.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/FormStepNewRenderer-xivyxo5L.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/LeafletMap-aj8wPyXu.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/Progress-BpqfAKK6.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/_flatRest-ByzTessp.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/formio-init-Cw_YCwCA.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/bundles/assets/formio-init-Cw_YCwCA.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
New obfuscated file: dist/bundles/assets/index-BagiJKHG.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
HIGH
New obfuscated file: dist/bundles/assets/index-H9jIe7z6.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/nl-CFhPqV3d.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/bundles/assets/sdk-C9SeBnp5.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
HIGH
New file with network + code execution: dist/bundles/assets/sdk-C9SeBnp5.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.4.2
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.4.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.