@powersync/web

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Package contains compiled binaries that could be backdoors: • dist/2075a31bb151adbb9767.wasm • dist/3322bc84de986b63c2cd.wasm • dist/8e97452e297be23b5e50.wasm • dist/fbc178b70d530e8ce02b.wasm

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Package contains compiled binaries that could be backdoors: • dist/2075a31bb151adbb9767.wasm • dist/3322bc84de986b63c2cd.wasm • dist/8e97452e297be23b5e50.wasm • dist/fbc178b70d530e8ce02b.wasm

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Package contains compiled binaries that could be backdoors: • dist/26d61ca9f5694d064635.wasm • dist/b4c6283dc473b6b3fd24.wasm • dist/c78985091a0b22aaef03.wasm • dist/ca59e199e1138b553fad.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (journeyapps-platform) on 2026-03-30, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

Package contains compiled binaries that could be backdoors: • dist/26d61ca9f5694d064635.wasm • dist/b4c6283dc473b6b3fd24.wasm • dist/c78985091a0b22aaef03.wasm • dist/ca59e199e1138b553fad.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (journeyapps-platform) on 2026-03-24, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

Package contains compiled binaries that could be backdoors: • dist/26d61ca9f5694d064635.wasm • dist/b4c6283dc473b6b3fd24.wasm • dist/c78985091a0b22aaef03.wasm • dist/ca59e199e1138b553fad.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (journeyapps-platform) on 2026-03-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

Package contains compiled binaries that could be backdoors: • dist/26d61ca9f5694d064635.wasm • dist/b4c6283dc473b6b3fd24.wasm • dist/c78985091a0b22aaef03.wasm • dist/ca59e199e1138b553fad.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (journeyapps-platform) on 2026-03-04, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

Package contains compiled binaries that could be backdoors: • dist/26d61ca9f5694d064635.wasm • dist/b4c6283dc473b6b3fd24.wasm • dist/c78985091a0b22aaef03.wasm • dist/ca59e199e1138b553fad.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (journeyapps-platform) on 2026-02-19, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

Package contains compiled binaries that could be backdoors: • dist/0b19af1befc07ce338dd.wasm • dist/2632c3bda9473da74fd5.wasm • dist/64f5351ba3784bfe2f3e.wasm • dist/9318ca94aac4d0fe0135.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (journeyapps-platform) on 2026-02-16, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

Package contains compiled binaries that could be backdoors: • dist/0b19af1befc07ce338dd.wasm • dist/2632c3bda9473da74fd5.wasm • dist/64f5351ba3784bfe2f3e.wasm • dist/9318ca94aac4d0fe0135.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • dist/0b19af1befc07ce338dd.wasm • dist/2632c3bda9473da74fd5.wasm • dist/64f5351ba3784bfe2f3e.wasm • dist/9318ca94aac4d0fe0135.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • dist/0b19af1befc07ce338dd.wasm • dist/2632c3bda9473da74fd5.wasm • dist/64f5351ba3784bfe2f3e.wasm • dist/9318ca94aac4d0fe0135.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • dist/10072fe45f0a8fab0a0e.wasm • dist/6e435e51534839845554.wasm • dist/a730f7ca717b02234beb.wasm • dist/aa2f408d64445fed090e.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • dist/10072fe45f0a8fab0a0e.wasm • dist/6e435e51534839845554.wasm • dist/a730f7ca717b02234beb.wasm • dist/aa2f408d64445fed090e.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • dist/10072fe45f0a8fab0a0e.wasm • dist/6e435e51534839845554.wasm • dist/a730f7ca717b02234beb.wasm • dist/aa2f408d64445fed090e.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • dist/10072fe45f0a8fab0a0e.wasm • dist/6e435e51534839845554.wasm • dist/a730f7ca717b02234beb.wasm • dist/aa2f408d64445fed090e.wasm

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.