← Home

@ray-js/robot-map-sdk

A high-performance 2D robot vacuum cleaner map SDK based on PIXI.js.

13
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

tuyafe

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist-docs/assets/chunks/index.Dmmvsq5C.js AI (source-diff): Bundled vite chunk; network+eval pattern from framework code, no fetched payload. ai
source-diff obfuscated-file:dist-docs/assets/chunks/index.Dmmvsq5C.js AI (source-diff): Vite-bundled vitepress/pixi docs build; minified not obfuscated. ai
source-diff obfuscated-file:dist-docs/assets/chunks/index.DR0yN-kU.js AI (source-diff): Vite-bundled vitepress/pixi docs site output, not injected obfuscation. ai
source-diff net-exec-file:dist-docs/assets/chunks/index.DR0yN-kU.js AI (source-diff): Bundled vite/pixi runtime code, no concrete exfil behavior observed. ai
source-diff net-exec-file:dist-app/assets/index-DMEnUYiD.js AI (source-diff): Bundled pixi.js/app build output, not a dropper. ai
source-diff net-exec-file:dist-docs/assets/chunks/index.CvitVYBK.js AI (source-diff): VitePress theme bundle, standard docs build output. ai
source-diff obfuscated-file:dist-docs/assets/chunks/@localSearchIndexroot.D-feMZmG.js AI (source-diff): VitePress local-search index JSON blob, not obfuscated code. ai
source-diff obfuscated-file:dist-docs/assets/chunks/@localSearchIndexroot.qz-xy3_N.js AI (source-diff): vitepress local search index JSON, not obfuscation. ai
source-diff obfuscated-file:dist-app/assets/index-Cb0Ul36y.js AI (source-diff): Vite/esbuild bundled app output. ai
source-diff obfuscated-file:dist-docs/assets/chunks/@localSearchIndexroot.jsScsXKs.js AI (source-diff): VitePress search index JSON, not obfuscation. ai
source-diff obfuscated-file:dist-docs/assets/chunks/VPLocalSearchBox.BiAazhoT.js AI (source-diff): VitePress search UI component bundle. ai
source-diff obfuscated-file:dist-docs/assets/chunks/theme.D2rRQxPQ.js AI (source-diff): VitePress theme chunk, bundled output. ai
source-diff obfuscated-file:dist-docs/assets/reference_runtime.md.BnT09w_m.js AI (source-diff): VitePress doc bundle. ai
source-diff obfuscated-file:dist-docs/assets/reference_methods.md.BNxMKwmx.js AI (source-diff): VitePress doc bundle. ai
source-diff obfuscated-file:dist-docs/assets/reference_config.md.DLC4kvTR.js AI (source-diff): VitePress doc bundle. ai
source-diff obfuscated-file:dist-docs/assets/reference_callbacks.md.CZ8IiuH-.js AI (source-diff): VitePress doc bundle. ai
source-diff net-exec-file:dist-app/assets/index-Cb0Ul36y.js AI (source-diff): Bundled app JS, standard fetch/eval helper shapes from bundler, no exfil target. ai
source-diff obfuscated-file:dist-docs/assets/chunks/@localSearchIndexroot.KFmfCW62.js AI (source-diff): VitePress local search index JSON, not obfuscated code. ai
source-diff obfuscated-file:dist-docs/assets/guide_advanced-usage.md.B4LS-34s.js AI (source-diff): VitePress-rendered docs markdown chunk, bundled not obfuscated. ai
source-diff obfuscated-file:dist-app/assets/index-DBiLhFZl.js AI (source-diff): esbuild/vite bundled app output, standard bundler helpers. ai
source-diff net-exec-file:dist-app/assets/index-DBiLhFZl.js AI (source-diff): Bundled web app; network+exec pattern comes from bundled libs, no hostile target shown. ai
source-diff net-exec-file:dist-docs/assets/chunks/index.BXtdqYEZ.js AI (source-diff): Bundled docs site code, no concrete malicious destination shown. ai
source-diff obfuscated-file:dist-docs/assets/chunks/index.BXtdqYEZ.js AI (source-diff): Vite-bundled VitePress docs chunk, not obfuscation. ai
source-diff net-exec-file:bin/mcp-server.js AI (source-diff): Bundled MCP server dependencies (ajv/zod), not malicious loader. ai
source-diff obfuscated-file:bin/mcp-server.js AI (source-diff): tsup-bundled MCP server matching mcp:build script, not obfuscation. ai
source-diff net-exec-file:dist-app/assets/index-BzBtiwcY.js AI (source-diff): Bundled framework code containing fetch+Function, not a loader/dropper. ai
bogus-package bogus-package AI (bogus-package): Established Tuya org package with docs site; README/metadata gaps are not malicious. ai
source-diff obfuscated-file:dist-app/assets/index-BzBtiwcY.js AI (source-diff): Vite/vitepress bundled app output, not true obfuscation. ai
dependencies unvetted-dep:@ray-js/webview-invoke AI (dependencies): Same Tuya/@ray-js org scope; consistent with package's ecosystem. ai
dependencies unvetted-dep:@ray-js/robot-protocol AI (dependencies): Same Tuya/@ray-js org scope; consistent with package's ecosystem. ai
phantom-deps phantom-dep:@ray-js/webview-invoke AI (phantom-deps): Same-org dep; likely re-exported or used indirectly via bundler; stable false positive. ai
phantom-deps phantom-dep:normalize.css AI (phantom-deps): CSS dep referenced via config; stable false positive. ai
phantom-deps phantom-dep:lodash-es AI (phantom-deps): Same bundler/config usage pattern; stable false positive. ai
phantom-deps phantom-dep:gifuct-js AI (phantom-deps): Same bundler/config usage pattern; stable false positive. ai
phantom-deps phantom-dep:valtio AI (phantom-deps): Same bundler/config usage pattern; stable false positive. ai
phantom-deps phantom-dep:nanoid AI (phantom-deps): Declared runtime dep used via bundler/config, not direct import; stable pattern for this package. ai
phantom-deps phantom-dep:patch-package AI (phantom-deps): Used in postinstall script, not a direct import; stable false positive. ai
install-scripts install-script:postinstall AI (install-scripts): patch-package postinstall is a standard dependency-patching pattern; stable for this package. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same docs-server.js context; expected behavior for a background server process. ai
semgrep semgrep:new-function-constructor AI (semgrep): Fires in bundled VitePress/WebGL dist-docs assets (Vue framework + BufferResource shader compiler), not user-facing library code. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Fires in bundled Vue 3 framework code in dist-docs; Reflect.get is idiomatic Vue reactivity internals. ai
semgrep semgrep:silent-process-exec AI (semgrep): Detached spawn is in bin/docs-server.js (dev docs server binary), not runtime library code. ai

Versions (showing 13 of 13)

Version Deps Published
0.0.15 11 / 31
0.0.14 11 / 30
0.0.13 11 / 28
0.0.12 11 / 28
0.0.11 11 / 28
0.0.10 11 / 28
0.0.9 10 / 27
0.0.8 10 / 27
0.0.7 10 / 27
0.0.6 10 / 27
0.0.4 10 / 23
0.0.3 10 / 23
0.0.2 10 / 23

v0.0.13

29 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.DELY0TLT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/BitmapFont.DDRqV796.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/browserAll.CXRAifqY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/CanvasRenderer.BefGXFZ-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/framework.CBLqO2Q1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.COVLyRkA.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_mcp.md.CabCiX8Z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/index.Dmmvsq5C.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New file with network + code execution: dist-docs/assets/chunks/index.Dmmvsq5C.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/mapValues.D2X8cRgC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-detected-objects-visibility-design.md.Dqboot5W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-show-detected-objects-implementation-plan.md.CDWwQtWj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-design.md.BVmEzCbR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-implementation-plan.md.S2f1zs9-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-design.md.mqeNaYgg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-implementation-plan.md.BXG1UWFt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-11-simulator-logger-dump-implementation-plan.md.Ck5BGdoX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-02-28-fix-pixi-bindgroup-webgpu-snapshot-whitescreen-bugfix.md.BbQpA41Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-events-drawer-toolbar-scroll-bugfix.md.DbHxPv4D.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-simulator-initial-render-layout-bugfix.md.w7--2hvH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-11-docs-server-bin-clean-bugfix.md.GGWCjkok.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — minified bundler output, not obfuscation on its own.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-11-render-result-runtime-sync-bugfix.md.DRNUuaFT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.12

29 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.Eymr9Nu7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/BitmapFont.CXuoJus7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/browserAll.De-cmVZB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/CanvasRenderer.DT-IZ40Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/framework.CBLqO2Q1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.COVLyRkA.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_mcp.md.CabCiX8Z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/index.BXtdqYEZ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New file with network + code execution: dist-docs/assets/chunks/index.BXtdqYEZ.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/mapValues.D2X8cRgC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-detected-objects-visibility-design.md.Dqboot5W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-show-detected-objects-implementation-plan.md.CDWwQtWj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-design.md.BVmEzCbR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-implementation-plan.md.S2f1zs9-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-design.md.mqeNaYgg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-implementation-plan.md.BXG1UWFt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-02-28-fix-pixi-bindgroup-webgpu-snapshot-whitescreen-bugfix.md.BbQpA41Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-events-drawer-toolbar-scroll-bugfix.md.DbHxPv4D.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-simulator-initial-render-layout-bugfix.md.w7--2hvH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-11-docs-server-bin-clean-bugfix.md.GGWCjkok.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — minified bundler output, not obfuscation on its own.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-02-furniture-feature-plan.md.CqSsyNDo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-10-simulator-events-console-plan.md.CfHLEHcc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

29 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.l5uunL9n.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/BitmapFont.C8awBCd1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/browserAll.BebatlLr.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/CanvasRenderer.DyglCOE2.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/framework.CBLqO2Q1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.COVLyRkA.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_mcp.md.CabCiX8Z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/index.DR0yN-kU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New file with network + code execution: dist-docs/assets/chunks/index.DR0yN-kU.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/mapValues.D2X8cRgC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-detected-objects-visibility-design.md.Dqboot5W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-show-detected-objects-implementation-plan.md.CDWwQtWj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-design.md.BVmEzCbR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-implementation-plan.md.S2f1zs9-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-design.md.mqeNaYgg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-implementation-plan.md.BXG1UWFt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-02-28-fix-pixi-bindgroup-webgpu-snapshot-whitescreen-bugfix.md.BbQpA41Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-events-drawer-toolbar-scroll-bugfix.md.DbHxPv4D.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-simulator-initial-render-layout-bugfix.md.w7--2hvH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-11-docs-server-bin-clean-bugfix.md.GGWCjkok.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (tsup) — minified bundler output, not obfuscation on its own.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-02-furniture-feature-plan.md.CqSsyNDo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-10-simulator-events-console-plan.md.CfHLEHcc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.10

29 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.5wY6DA9h.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/BitmapFont.BXsyt1Ko.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/browserAll.BxwMP9Gg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/CanvasRenderer.DpOhlsYI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/framework.CBLqO2Q1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.COVLyRkA.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_mcp.md.CabCiX8Z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/index.nS-neZH_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New file with network + code execution: dist-docs/assets/chunks/index.nS-neZH_.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-docs/assets/chunks/json-editor-vue.CBQvp8j1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/chunks/mapValues.D2X8cRgC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-detected-objects-visibility-design.md.Dqboot5W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-show-detected-objects-implementation-plan.md.CDWwQtWj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-design.md.BVmEzCbR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-events-console-implementation-plan.md.S2f1zs9-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-design.md.mqeNaYgg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-10-simulator-runtime-controls-implementation-plan.md.BXG1UWFt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-02-28-fix-pixi-bindgroup-webgpu-snapshot-whitescreen-bugfix.md.BbQpA41Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-events-drawer-toolbar-scroll-bugfix.md.DbHxPv4D.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-03-10-simulator-initial-render-layout-bugfix.md.w7--2hvH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-02-furniture-feature-plan.md.CqSsyNDo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-10-simulator-events-console-plan.md.CfHLEHcc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-10-simulator-last-successful-combo-cache-plan.md.Z2RoK239.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.9

18 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.HZmZuAtg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.BPrKHNKt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_mcp.md.1UIpY4E0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-BzBtiwcY.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-detected-objects-visibility-design.md.530AI9zE.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/plans_2026-03-04-show-detected-objects-implementation-plan.md.foeG7qiK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_bugs_2026-02-28-fix-pixi-bindgroup-webgpu-snapshot-whitescreen-bugfix.md.BT3816jW.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/records_plans_2026-03-02-furniture-feature-plan.md.DkXKivuL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_callbacks.md.CwvDSJWk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_config.md.CK4ueBig.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_methods.md.CL2sjTJ7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_runtime.md.aDpGKfHs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/theme.D78lSkQK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/VPLocalSearchBox.D9iYIKMO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.8

14 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.KFmfCW62.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.B4LS-34s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_mcp.md.1UIpY4E0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-DBiLhFZl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-DBiLhFZl.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/reference_callbacks.md.CZ8IiuH-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_config.md.DLC4kvTR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_methods.md.BNxMKwmx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_runtime.md.BnT09w_m.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/theme.XkHDjgfO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/VPLocalSearchBox.BrTaQHuH.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.7

13 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.qz-xy3_N.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.B4LS-34s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-Cb0Ul36y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-Cb0Ul36y.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/reference_callbacks.md.CZ8IiuH-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_config.md.DLC4kvTR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_methods.md.BNxMKwmx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_runtime.md.BnT09w_m.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/theme.CdCUaiEQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/VPLocalSearchBox.CCdb1CAu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.6

13 findings
HIGH New obfuscated file: dist-docs/assets/chunks/@localSearchIndexroot.jsScsXKs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/guide_advanced-usage.md.B4LS-34s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-app/assets/index-Cb0Ul36y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist-app/assets/index-Cb0Ul36y.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: bin/mcp-server.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: bin/mcp-server.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist-docs/assets/reference_callbacks.md.CZ8IiuH-.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_config.md.DLC4kvTR.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_methods.md.BNxMKwmx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/reference_runtime.md.BnT09w_m.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist-docs/assets/chunks/theme.D2rRQxPQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (vite) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH New obfuscated file: dist-docs/assets/chunks/VPLocalSearchBox.BiAazhoT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.