← Home

@pdfme/converter

npm Repository Homepage

TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!

28
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

hand-dot

Keywords

pdfpdf-designerpdf-generationpdf-viewerreacttypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/assets/pdfjs-worker-Vdj5Aq5w.js AI (source-diff): Bundled pdfjs-dist worker output, not true obfuscation. ai
source-diff net-exec-file:dist/assets/pdfjs-worker-Vdj5Aq5w.js AI (source-diff): PDF.js worker network+exec patterns are expected for a PDF rendering worker. ai
source-diff net-exec-file:dist/assets/pdfjs-worker-CxCIrMGa.js AI (source-diff): PDF.js worker code inherently does dynamic parsing/exec; no hostile network target found. ai
source-diff obfuscated-file:dist/assets/pdfjs-worker-CxCIrMGa.js AI (source-diff): Minified pdfjs-dist worker bundle, not true obfuscation; long lines from bundler. ai
source-diff net-exec-file:dist/assets/clawpdf-worker-BXU-6mDf.js AI (source-diff): Worker bundle for PDF conversion lib; network+exec pattern is bundler artifact, not dropper behavior. ai
source-diff obfuscated-file:dist/assets/clawpdf-worker-BXU-6mDf.js AI (source-diff): Bundler (rolldown/oxc) build output for new clawpdf worker dep, not true obfuscation. ai
source-diff source-size-tripled AI (source-diff): Size increase is due to bundling the 2MB pdfjs-dist worker; expected and benign. ai
source-diff obfuscated-file:dist/assets/pdfjs-worker-BpS0tFhy.js AI (source-diff): File is the bundled pdfjs-dist worker (Mozilla Apache-2.0); minification is expected for this dependency. ai
source-diff net-exec-file:dist/assets/pdfjs-worker-BpS0tFhy.js AI (source-diff): Network+exec pattern is inherent to the PDF.js worker; not malicious in this context. ai
source-diff net-exec-file:dist/assets/pdfjs-worker-DNts7nT2.js AI (source-diff): pdfjs worker legitimately uses network (fetch PDF data) and dynamic execution; standard behavior for this Mozilla library. ai
source-diff obfuscated-file:dist/assets/pdfjs-worker-DNts7nT2.js AI (source-diff): This is the bundled pdfjs-dist worker (Mozilla Foundation, Apache 2.0); minification is expected for this artifact. ai
npm-metadata suspicious-initial-version AI (npm-metadata): 0.0.0 is a stable monorepo convention for @pdfme/* packages, not a throwaway pattern. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publisher with SLSA attestation; legitimate automation handoff for pdfme monorepo. ai
dependencies unvetted-dep:@pdfme/common AI (dependencies): Same pdfme monorepo sibling; wildcard version is standard monorepo practice, not a supply-chain risk. ai

Versions (showing 28 of 28)

Version Deps Published
6.1.11 6 / 3
6.1.10 6 / 3
6.1.9 6 / 3
6.1.8 6 / 3
6.1.6 7 / 3
6.1.5 7 / 3
6.1.3 7 / 3
6.1.2 7 / 3
6.1.1 4 / 1
6.1.0 4 / 1
6.0.6 4 / 1
6.0.5 4 / 1
6.0.3 4 / 1
6.0.0 4 / 1
5.5.10 3 / 3
5.5.9 3 / 3
5.5.8 3 / 3
5.5.7 3 / 3
5.5.6 3 / 3
5.5.5 3 / 3
5.5.4 3 / 3
5.5.3 3 / 3
5.5.2 3 / 3
5.5.1 3 / 3
5.5.0 3 / 3
5.4.8 3 / 3
5.4.7 3 / 3
0.0.0 3 / 3

v6.1.11

3 findings
HIGH New obfuscated file: dist/assets/clawpdf-worker-BXU-6mDf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/assets/clawpdf-worker-BXU-6mDf.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.