@perceptimagery/dita-configurator
| An embeddable package for Dita's 3D configurator
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Bundled Three.js shader/minified code, not obfuscation or a payload. | ai | |
| dependencies | unvetted-dep:@perceptimagery/sprie-widget-auth | AI (dependencies): Same-org scoped internal package, consistent with sibling sprie-asset-auth already accepted. | ai | |
| dependencies | unvetted-dep:dat.gui | AI (dependencies): dat.gui is a well-known, established GUI library; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@perceptimagery/3d-configurator | AI (dependencies): Same-org dependency from the same publisher; not an independent risk. | ai | |
| dependencies | unvetted-dep:@perceptimagery/sprie-asset-auth | AI (dependencies): Same-org dependency from the same publisher; not an independent risk. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): React is a peer/bundled dep in a component library; phantom-dep heuristic is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:@perceptimagery/sprie-asset-auth | AI (phantom-deps): Same-org dependency; phantom-dep heuristic unreliable for bundled org packages. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Same as react — expected in a React component library build. | ai | |
| phantom-deps | phantom-dep:events | AI (phantom-deps): Likely used transitively or in bundled output; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:dat.gui | AI (phantom-deps): 3D configurator UI dep; may be consumed indirectly via bundled output. | ai | |
| phantom-deps | phantom-dep:@perceptimagery/3d-configurator | AI (phantom-deps): Same-org dependency; phantom-dep heuristic unreliable for bundled org packages. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 1.3.24 | 7 / 20 | |
| 1.3.22 | 7 / 20 | |
| 1.3.21 | 6 / 20 | |
| 1.3.15 | 6 / 20 | |
| 1.3.14 | 6 / 20 |
v1.3.24
3 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (satputerohan) than the most recent previously approved version (nilesh-percept) on 2026-07-07, but satputerohan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.