← Home

@profoundlogic/coderflow-server

npm Homepage

AI Coder Server - Manages Docker containers for AI agent task execution

30
Versions
SEE LICENSE IN LICENSE.txt
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

profoundlogic

Keywords

aicoderdockerautomation

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/web-ui/public/template-parameter-form.js AI (source-diff): Obfuscation from package's own javascript-obfuscator build step; benign form-render code. ai
publish-pattern new-deps-added AI (publish-pattern): New deps (ssh2, monaco-editor, sibling org packages) match stated IBM i/coder tooling scope. ai
source-diff obfuscated-file:dist/lib/change-tracker.js AI (source-diff): Same obfuscator build step, first-party code, no malicious behavior in sample. ai
source-diff obfuscated-file:dist/web-ui/public/admin.js AI (source-diff): Package ships javascript-obfuscator as a devDependency; this is the documented build pipeline. ai
phantom-deps phantom-dep:@anthropic-ai/sdk AI (phantom-deps): New official Anthropic SDK backing the added assistant-* feature files. ai
source-diff obfuscated-file:dist/lib/assistant-agent.js AI (source-diff): Deliberate obfuscator build step (devDep javascript-obfuscator), not injected code. ai
source-diff obfuscated-file:dist/lib/auth-bypass.js AI (source-diff): Whole dist/ is obfuscated via declared javascript-obfuscator devDep; file is a benign env-gated DISABLE_AUTH feature, no network/exfil. ai
provenance no-provenance AI (provenance): Established publisher, manual publish; absence of Sigstore attestation is not a regression for this commercial package. ai
source-diff obfuscated-file:dist/lib/scoped-rbac-migration-runner.js AI (source-diff): Same intentional obfuscation build step, no malicious behavior in sample. ai
source-diff obfuscated-file:dist/lib/cli/migrate-rbac.js AI (source-diff): Same intentional obfuscation build step, no malicious behavior in sample. ai
source-diff obfuscated-file:dist/lib/external-connections.js AI (source-diff): Package ships javascript-obfuscator as build tool; intentional minification, not injected malware. ai
source-diff obfuscated-file:dist/lib/rbac-user-state.js AI (source-diff): Same intentional obfuscation build step, no malicious behavior in sample. ai
source-diff net-exec-file:dist/web-ui/public/vendor/docsify/4.13.1/lib/docsify.min.js AI (source-diff): Vendored docsify.min.js is a well-known documentation library; net+exec pattern is expected. ai
source-diff net-exec-file:dist/web-ui/public/vendor/mermaid/11.13.0/dist/mermaid.min.js AI (source-diff): Vendored mermaid.min.js is a well-known diagramming library; net+exec pattern is expected. ai
phantom-deps phantom-dep:@profoundlogic/codermake AI (phantom-deps): Same-org dep; likely loaded dynamically or via plugin pattern. ai
phantom-deps phantom-dep:@profoundlogic/aitool AI (phantom-deps): Same-org dep; likely loaded dynamically or via plugin pattern. ai
phantom-deps phantom-dep:ssh2 AI (phantom-deps): Server framework with many optional runtime deps loaded dynamically; consistent pattern across all versions. ai
phantom-deps phantom-dep:web-push AI (phantom-deps): Optional capability in server framework; same dynamic-load pattern as other accepted phantom deps. ai
phantom-deps phantom-dep:botbuilder AI (phantom-deps): Optional bot integration capability; consistent with package's server framework pattern. ai
phantom-deps phantom-dep:monaco-editor AI (phantom-deps): Optional editor dependency; consistent with package's server framework pattern. ai
phantom-deps phantom-dep:node-cron AI (phantom-deps): Bundled dist package; node-cron is a newly added legitimate dependency consistent with version diff. ai
phantom-deps phantom-dep:diff AI (phantom-deps): Bundled dist package; diff is a newly added legitimate dependency consistent with version diff. ai
phantom-deps phantom-dep:http-proxy-middleware AI (phantom-deps): http-proxy-middleware is a declared dependency appropriate for this server platform; dynamic loading explains lack of direct import. ai
phantom-deps phantom-dep:ejs AI (phantom-deps): ejs is a declared dependency used as a configurable template engine in this server platform; dynamic loading explains lack of direct import. ai
phantom-deps phantom-dep:bcrypt AI (phantom-deps): bcrypt is a declared dependency used for auth in this server platform; dynamic loading pattern explains lack of direct import. ai
phantom-deps phantom-dep:dotenv AI (phantom-deps): dotenv is a declared dependency for environment config; dynamic/conditional loading is common in server platforms. ai
phantom-deps phantom-dep:multer AI (phantom-deps): multer is a declared dependency for file uploads; dynamic loading in a server platform is expected. ai
phantom-deps phantom-dep:tar-fs AI (phantom-deps): tar-fs is declared and appropriate for Docker container management; dynamic loading explains lack of direct import. ai
phantom-deps phantom-dep:minimatch AI (phantom-deps): minimatch is a declared utility dependency; dynamic loading in a server platform is expected. ai
phantom-deps phantom-dep:http-proxy AI (phantom-deps): http-proxy is declared and appropriate for a server platform managing proxied Docker containers; dynamic loading explains lack of direct import. ai
phantom-deps phantom-dep:mime-types AI (phantom-deps): mime-types is a declared utility dependency; dynamic loading in a server platform is expected. ai
phantom-deps phantom-dep:nodemailer AI (phantom-deps): nodemailer is a declared dependency for email; dynamic/optional loading in a server platform is a stable pattern. ai
phantom-deps phantom-dep:compression AI (phantom-deps): compression is a declared middleware dependency; dynamic loading in a server platform is expected. ai
phantom-deps phantom-dep:memorystore AI (phantom-deps): memorystore is a declared session store dependency; dynamic loading in a server platform is expected. ai
phantom-deps phantom-dep:jsonwebtoken AI (phantom-deps): jsonwebtoken is a declared auth dependency; dynamic loading in a server platform is a stable pattern. ai
phantom-deps phantom-dep:openid-client AI (phantom-deps): openid-client is a declared auth dependency; dynamic loading in a server platform is expected. ai
phantom-deps phantom-dep:express-session AI (phantom-deps): express-session is a declared middleware dependency; dynamic loading in a server platform is expected. ai
dependencies unvetted-dep:http-proxy AI (dependencies): http-proxy is a well-established, widely-used npm package; unvetted-dep finding reflects review system state, not actual risk. ai
phantom-deps phantom-dep:dockerode AI (phantom-deps): Core dependency for Docker container management — the package's primary purpose. Phantom detection is a false positive. ai
phantom-deps phantom-dep:sharp AI (phantom-deps): Image processing dep declared for runtime use; known implicit/binary dependency pattern is expected for this package. ai
phantom-deps phantom-dep:ws AI (phantom-deps): WebSocket support declared as runtime dep for a server product; phantom detection is a false positive for this package's architecture. ai
phantom-deps phantom-dep:express AI (phantom-deps): Server framework package; express and peer deps are declared for runtime use by the application, consistent with a config-driven server product. ai

Versions (showing 30 of 30)

Version Deps Published
0.12.114 30 / 2
0.12.93 29 / 2
0.12.79 28 / 2
0.12.72 27 / 2
0.12.71 27 / 2
0.12.70 27 / 2
0.12.31 26 / 2
0.12.30 26 / 2
0.12.28 26 / 2
0.12.25 26 / 2
0.12.24 26 / 2
0.12.23 26 / 2
0.12.22 26 / 2
0.12.21 26 / 2
0.12.20 26 / 2
0.12.19 26 / 2
0.10.15 25 / 2
0.10.1 24 / 2
0.4.9 22 / 2
0.4.7 21 / 2
0.4.4 20 / 1
0.4.2 19 / 1
0.4.1 19 / 1
0.4.0 19 / 1
0.3.2 19 / 1
0.3.1 19 / 1
0.2.8 19 / 1
0.2.7 19 / 1
0.2.3 19 / 1
0.2.1 19 / 1

v0.12.79

22 findings
HIGH Phantom dependency: @anthropic-ai/sdk phantom-deps

Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/1498.eae82acc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/2fc4f567.4bc59b6c.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/351c0f55.cd933f5a.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/3d69159e.0a0e76cd.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/69ae5549.af7a0aaf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/a3377686.fd4305ce.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ask-coderflow.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-agent.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-data.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-docs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-inquiries.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-telemetry-config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-telemetry-push.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/assistant-tools.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/routes/assistant.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/build-batch-service.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/build-info.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/build-progress.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/assets/js/f5c229c6.0a638104.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/field-harvest.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.71

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.28

4 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/follow-up-task.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/template-parameter-form.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.25

3 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/template-parameter-form.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.24

3 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/template-parameter-form.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.23

2 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.22

2 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.21

2 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.20

2 findings
HIGH New obfuscated file: dist/lib/auth-bypass.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.15

37 findings
HIGH New obfuscated file: dist/web-ui/public/admin.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/change-tracker.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/cleanup-users.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/commit-message-generator.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/compression-filter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/docsify-proxy-helper.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/external-connections.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/file-selection-tree.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/git-branch-actions.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/grant-admin.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ibmi-activity.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-file-filter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ibmi-file-selection.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-analysis.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-auth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-buildability.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-download.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-repo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-rules.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-settings.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/routes/ibmi-import-sources.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ibmi-import-sources.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-ssh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/routes/ibmi-import.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ibmi-import.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-richdisplay.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-sync.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/judge-task-context.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/list-roles.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/list-users.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/local-git-history.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/routes/logs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/memory-utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/order-utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/playwright.task-ibmi-activity.config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/playwright.task-terminal.config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.1

32 findings
HIGH New obfuscated file: dist/web-ui/public/admin.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/change-tracker.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/cleanup-users.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/commit-message-generator.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/compression-filter.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/docs/docsify-proxy-helper.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/external-connections.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/file-selection-tree.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/grant-admin.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ibmi-activity.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-analysis.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-auth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-buildability.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-download.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-repo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-rules.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-import-ssh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/routes/ibmi-import.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/web-ui/public/ibmi-import.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/ibmi-sync.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/list-roles.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/list-users.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/routes/logs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/memory-utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/order-utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/playwright.task-ibmi-activity.config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/playwright.task-terminal.config.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/pui-deploy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/rbac-user-state.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/session-file-store.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/set-password.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.9

11 findings
HIGH New obfuscated file: dist/lib/external-connections.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/cli/migrate-rbac.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/rbac-user-state.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH New obfuscated file: dist/lib/scoped-rbac-migration-runner.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH Long encoded string in modified file: dist/web-ui/public/activity-detail-modal.js source-diff

Modified file contains 7 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH Long encoded string in modified file: dist/web-ui/public/activity-feed.js source-diff

Modified file contains 4 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH Long encoded string in modified file: dist/web-ui/public/activity-formatters.js source-diff

Modified file contains 23 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH Long encoded string in modified file: dist/web-ui/public/agent-event-parser.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH Long encoded string in modified file: dist/web-ui/public/app.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.

HIGH Long encoded string in modified file: dist/web-ui/public/approve-dialog.js source-diff

Modified file contains 4 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.