@progress/kendo-licensing
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Used within obfuscated license CLI, not a real phantom dependency. | ai | |
| provenance | no-provenance | AI (provenance): Established vendor publishes manually; unchanged provenance. | ai | |
| source-diff | encoded-string-file:dist/index-esm.js | AI (source-diff): Intentional obfuscation of license-validation logic; stable for this vendor package. | ai | |
| source-diff | encoded-string-file:bin/kendo-ui-license.js | AI (source-diff): License activation CLI, intentionally obfuscated anti-tamper. | ai | |
| source-diff | encoded-string-file:dist/index.mjs | AI (source-diff): Obfuscated license enforcement, benign. | ai | |
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Obfuscated license enforcement, no hostile destination. | ai | |
| semgrep | semgrep:obfuscation-while-true | AI (semgrep): javascript-obfuscator output in vendor license code. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Progress/Telerik commercial package; README link dump is typical for vendor licensing docs. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in license activation CLI binary; expected for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding used for JWT/license key parsing; expected in a license validation tool. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Process spawning in license CLI binary; consistent with documented activation flow. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs the package's own license-activation CLI; documented and stable for this package. | ai | |
| phantom-deps | phantom-dep:jsonwebtoken | AI (phantom-deps): jsonwebtoken is a declared runtime dependency; phantom-dep heuristic misfires here. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require inside intentionally obfuscated license CLI; stable false positive for this package. | ai | |
| semgrep | semgrep:obfuscation-hex-functions | AI (semgrep): Obfuscation is intentional; javascript-obfuscator is a listed devDependency used to protect the license-check binary. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1.11.2 | 3 / 0 | |
| 1.11.1 | 3 / 0 | |
| 1.11.0 | 3 / 0 | |
| 1.10.1 | 3 / 0 | |
| 1.9.1 | 3 / 0 | |
| 1.8.0 | 2 / 0 | |
| 1.7.1 | 2 / 0 | |
| 1.5.0 | 1 / 0 | |
| 1.3.5 | 1 / 18 |
v1.11.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
6 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.
Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: obfuscated (_0x-array) — true obfuscation signature.
while(!![]) loop is a signature of javascript-obfuscator output Source: https://github.com/telerik/kendo-licensing/blob/518ee0392eca6314f88cc1c7139d3a0b0cb6d070/bin/kendo-ui-license.js#L2 1 | #!/usr/bin/env node > 2 | 'use strict';const _0x19825c=_0x189a;(function(_0x33b58c,_0x294975){const _0x24c293=_0x189a,_0x5ca025=_0x33b58c();while( 3 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.