@phila/phila-ui-map-core
Core map utilities and styles for Phila UI library
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-hCjhfN8e.cjs | AI (source-diff): Standard Vite/Rollup minified bundle output for a Vue mapping component; base64 PNG embedded in JS is normal for icon assets. | ai | |
| phantom-deps | phantom-dep:@phila/phila-ui-checkbox | AI (phantom-deps): Same org scope; likely used transitively or in bundled output rather than direct import. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-Eji6FPOJ.js | AI (source-diff): Network calls are maplibre-gl tile fetches; dynamic code execution is Vue's defineAsyncComponent/resolveDynamicComponent — standard framework patterns. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-Eji6FPOJ.js | AI (source-diff): Standard Vite ESM bundle for Vue map components; content is normal Vue/maplibre-gl component code. | ai | |
| source-diff | obfuscated-file:dist/CyclomediaCameraIcon-DE9n1rqc.js | AI (source-diff): Standard Vite ESM bundle output; base64 PNG embedded in JS is normal for icon assets. | ai | |
| source-diff | net-exec-file:dist/PictometryPanel-CHEYonH5.cjs | AI (source-diff): Network calls are maplibre-gl tile fetches; dynamic code execution is Vue's defineAsyncComponent/resolveDynamicComponent — standard framework patterns. | ai | |
| source-diff | obfuscated-file:dist/PictometryPanel-CHEYonH5.cjs | AI (source-diff): Standard Vite/Rollup minified CJS bundle for Vue map components; content is normal Vue/maplibre-gl component code. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal @phila org package; missing repo/homepage is typical for org-internal scoped packages. | ai | |
| phantom-deps | phantom-dep:clsx | AI (phantom-deps): UI library; clsx likely used in build config or type declarations, not direct import. | ai | |
| phantom-deps | phantom-dep:@cyclomedia/streetsmart-api | AI (phantom-deps): CycloMedia API is the core map dependency; config-only reference is plausible. | ai | |
| phantom-deps | phantom-dep:@phila/phila-ui-search | AI (phantom-deps): Same org scope; sibling package reference in config is expected. | ai | |
| phantom-deps | phantom-dep:@turf/helpers | AI (phantom-deps): GIS utility; likely used in type declarations or build config for map package. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Same as react — config/type reference only. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Peer/config reference in map component; not a direct import concern. | ai | |
| phantom-deps | phantom-dep:pepjs | AI (phantom-deps): Map library polyfill; referenced in config files as documented. | ai |
v1.1.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.