@paperclipai/server
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Bundled vite chunk map, not malicious payload decoding. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/cynefin-VYW2F7L2-C-f0AYNp.js | AI (source-diff): Bundled vite/mermaid chunk, minified not obfuscated; part of standard UI build. | ai | |
| source-diff | net-exec-file:ui-dist/assets/cynefin-VYW2F7L2-C-f0AYNp.js | AI (source-diff): Bundled LSP/mermaid library code, no real network+exec malicious behavior. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq--KHi_Fmw.js | AI (source-diff): Bundled lodash/mermaid UI asset, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/index-lmXzxmTa.js | AI (source-diff): Bundled mermaid/cytoscape UI dist, minified not obfuscated. | ai | |
| source-diff | net-exec-file:ui-dist/assets/index-lmXzxmTa.js | AI (source-diff): Frontend bundle fetch calls, not a loader/dropper. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq-ClX8Mu1q.js | AI (source-diff): Vendor bundle (lodash) minified build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/arc-CQmTfzW4.js | AI (source-diff): Bundled d3 arc module, minified build output. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Monorepo internal package, benign metadata gap. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq-BvUCLYYD.js | AI (source-diff): Bundled lodash internals in Vite UI build, not obfuscation. | ai | |
| source-diff | net-exec-file:ui-dist/assets/index-BMlfLDqD.js | AI (source-diff): Bundled frontend app code, not a loader/dropper. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party @paperclipai adapter packages. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq-BiKo_T7Z.js | AI (source-diff): Bundled lodash internals, minified build output not obfuscation. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq-CT0JirXo.js | AI (source-diff): Bundled lodash internal chunk from Vite build, not obfuscation. | ai | |
| dependencies | unvetted-dep:embedded-postgres | AI (dependencies): Legitimate embedded DB dep matching server's local-dev functionality. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq-DgpBAaut.js | AI (source-diff): Vite/esbuild bundled vendor chunk (lodash internals), not obfuscation. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): pino-pretty is a runtime logging formatter referenced via config, not direct import; stable false positive. | ai | |
| phantom-deps | phantom-dep:embedded-postgres | AI (phantom-deps): embedded-postgres used via config/dynamic loading; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@paperclipai/skills-catalog | AI (phantom-deps): Same-org dep likely loaded dynamically; stable false positive. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/c4Diagram-YG6GDRKO-CSiImYhg.js | AI (source-diff): Minified mermaid C4 diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/_baseUniq-Yf0e0ao7.js | AI (source-diff): Standard Vite-minified UI bundle (lodash/mermaid internals); stable pattern for this package. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/arc-BxPVdJFf.js | AI (source-diff): Minified d3-arc geometry code from mermaid bundle; not malicious. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/architectureDiagram-VXUJARFQ-CRLQjsm5.js | AI (source-diff): Minified mermaid architecture diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/blockDiagram-VD42YOAC-Cv0RXnYt.js | AI (source-diff): Minified mermaid block diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/cose-bilkent-S5V4N54A-CUQfFeFw.js | AI (source-diff): Minified cose-bilkent cytoscape layout; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/dagre-6UL2VRFP-D8KlvbS8.js | AI (source-diff): Minified dagre graph layout; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/diagram-PSM6KHXK-BXGxYaSy.js | AI (source-diff): Minified mermaid diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/diagram-QEK2KX5R-BwL451yc.js | AI (source-diff): Minified mermaid diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/diagram-S2PKOQOG-Bk2hQbsM.js | AI (source-diff): Minified mermaid diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/erDiagram-Q2GNP2WA-BmPIDlVN.js | AI (source-diff): Minified mermaid ER diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/flowDiagram-NV44I4VS-C4uHCImX.js | AI (source-diff): Minified mermaid flow diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/ganttDiagram-JELNMOA3-CPojk2VW.js | AI (source-diff): Minified mermaid Gantt diagram chunk; standard UI build output. | ai | |
| source-diff | obfuscated-file:ui-dist/assets/gitGraphDiagram-V2S2FVAM-CHbdoxYR.js | AI (source-diff): Minified mermaid git graph chunk; standard UI build output. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large file count reflects Vite-chunked UI bundle; expected for a server package shipping a UI dist. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Automated CI/CD with SLSA provenance; rapid publish is expected in monorepo release pipelines. | ai | |
| typosquat | typosquat.levenshtein:semver | AI (typosquat): Scoped package @paperclipai/server is a legitimate monorepo sub-package, not an impersonation of 'semver'. The Levenshtein match is a false positive for this namespace. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 2026.707.0 | 37 / 14 | |
| 2026.626.0 | 36 / 14 | |
| 2026.618.0 | 35 / 14 | |
| 2026.609.0 | 35 / 14 | |
| 2026.529.0 | 35 / 14 | |
| 2026.525.0 | 35 / 14 | |
| 2026.517.0 | 35 / 14 | |
| 2026.513.0 | 34 / 14 | |
| 2026.512.0 | 34 / 14 | |
| 2026.428.0 | 32 / 14 | |
| 2026.427.0 | 32 / 14 | |
| 2026.416.0 | 32 / 14 |
v2026.707.0
28 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.