@phila/phila-ui-map-core
Core map utilities and styles for Phila UI library
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-Dd3Tpeqr.cjs | AI (source-diff): Minified bundler output referencing vue/maplibre, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-I2P6l7HN.js | AI (source-diff): Legit bundled UI code; no exfiltration/dropper behavior evident. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-I2P6l7HN.js | AI (source-diff): Bundled component output from Vite build, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-CR-dW72-.js | AI (source-diff): Minified ESM bundle output, matches package's map component purpose. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-DH7VPPS5.cjs | AI (source-diff): Standard bundled map-UI component code, not a dropper/loader. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-DH7VPPS5.cjs | AI (source-diff): Bundled Vue component output, no obfuscation signature. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-U4v9tQuT.js | AI (source-diff): Map library network calls in bundled build, not exfil/dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-BK4cTDw9.cjs | AI (source-diff): Bundled Vue component output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-sN08UTVp.cjs | AI (source-diff): Bundled Vue/maplibre-gl output for Cyclomedia integration. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-sN08UTVp.cjs | AI (source-diff): Map library network calls in bundled build, not exfil/dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-DQEOz81H.js | AI (source-diff): Bundled Vue component output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-U4v9tQuT.js | AI (source-diff): Bundled Vue/maplibre-gl output for Cyclomedia integration. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-YOmjprcJ.cjs | AI (source-diff): Bundled map/network library code (maplibre-gl), not a dropper. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-YOmjprcJ.cjs | AI (source-diff): Minified bundle output for map component. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-C2pfFnC5.cjs | AI (source-diff): Minified Vite/Rollup bundle output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-1-VgJ9tb.js | AI (source-diff): Bundled map library code, not dropper behavior. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase from newly bundled Cyclomedia StreetSmart dependency, matches added deps. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-1-VgJ9tb.js | AI (source-diff): Minified bundle output. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-BHEAJtFa.js | AI (source-diff): Minified bundle output. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-Eji6FPOJ.js | AI (source-diff): Standard Vite ESM bundle for Vue map components; content is normal Vue/maplibre-gl component code. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-Eji6FPOJ.js | AI (source-diff): Network calls are maplibre-gl tile fetches; dynamic code execution is Vue's defineAsyncComponent/resolveDynamicComponent — standard framework patterns. | ai | |
| phantom-deps | phantom-dep:@phila/phila-ui-checkbox | AI (phantom-deps): Same org scope; likely used transitively or in bundled output rather than direct import. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-hCjhfN8e.cjs | AI (source-diff): Standard Vite/Rollup minified bundle output for a Vue mapping component; base64 PNG embedded in JS is normal for icon assets. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-CHEYonH5.cjs | AI (source-diff): Standard Vite/Rollup minified CJS bundle for Vue map components; content is normal Vue/maplibre-gl component code. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-CHEYonH5.cjs | AI (source-diff): Network calls are maplibre-gl tile fetches; dynamic code execution is Vue's defineAsyncComponent/resolveDynamicComponent — standard framework patterns. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-DE9n1rqc.js | AI (source-diff): Standard Vite ESM bundle output; base64 PNG embedded in JS is normal for icon assets. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal @phila org package; missing repo/homepage is typical for org-internal scoped packages. | ai | |
| phantom-deps | phantom-dep:@cyclomedia/streetsmart-api | AI (phantom-deps): CycloMedia API is the core map dependency; config-only reference is plausible. | ai | |
| phantom-deps | phantom-dep:clsx | AI (phantom-deps): UI library; clsx likely used in build config or type declarations, not direct import. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Peer/config reference in map component; not a direct import concern. | ai | |
| phantom-deps | phantom-dep:pepjs | AI (phantom-deps): Map library polyfill; referenced in config files as documented. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Same as react — config/type reference only. | ai | |
| phantom-deps | phantom-dep:@phila/phila-ui-search | AI (phantom-deps): Same org scope; sibling package reference in config is expected. | ai | |
| phantom-deps | phantom-dep:@turf/helpers | AI (phantom-deps): GIS utility; likely used in type declarations or build config for map package. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.1.1 | 11 / 13 | |
| 1.1.0 | 11 / 13 | |
| 1.0.0 | 9 / 13 | |
| 0.0.3 | 8 / 13 | |
| 0.0.2 | 8 / 13 | |
| 0.0.1 | 5 / 10 |
v1.1.1
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.2
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.