@picovoice/picovoice-vue

Vue binding for Picovoice Web SDK

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

albhoerismikpicokyeodynamix70kenarsailavery

Keywords

picovoicewebvoicespeechrecognitionaiofflinemicrophonevuenluasrintentinferencerenderless

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	encoded-string-file:dist/esm/index.js	AI (source-diff): Base64 wake-word model data (Alexa/Picovoice keyword files), not hidden payload.	ai	2026/07/20
source-diff	encoded-string-file:dist/esm/index.min.js	AI (source-diff): Same base64 model data in minified bundle output.	ai	2026/07/20
source-diff	encoded-string-file:dist/iife/index.js	AI (source-diff): Same base64 model data, IIFE build.	ai	2026/07/20
source-diff	encoded-string-file:dist/iife/index.min.js	AI (source-diff): Same base64 model data, minified IIFE build.	ai	2026/07/20
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get() is used inside a standard Vue 3 Proxy-based reactive wrapper — idiomatic TypeScript, not obfuscation. Stable false positive for this package.	ai	2026/04/25

Versions (showing 4 of 4)

Version	Deps	Published
3.0.3	1 / 29	2023-11-16
3.0.2	1 / 29	2023-11-03
3.0.1	1 / 29	2023-10-26
3.0.0	1 / 29	2023-10-25

v3.0.2

5 findings

HIGH Long encoded string in modified file: dist/esm/index.js source-diff

Modified file contains 21 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/esm/index.min.js source-diff

Modified file contains 21 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/iife/index.js source-diff

Modified file contains 21 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/iife/index.min.js source-diff

Modified file contains 21 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.