@sarxina/sarxina-tools
Shared streaming utilities — Twitch chat manager, VTube Studio client, etc.
17
Versions
ISC
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
sarxina
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:vendor/live2d/live2dcubismcore.js | AI (source-diff): Live2D Cubism Core SDK — legitimate minified WebAssembly wrapper with official copyright header; stable vendor file for this package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is entirely attributable to the bundled Live2D Cubism Core vendor file, not injected payload. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from manual publish to GitHub Actions CI/CD; SLSA attestation confirms legitimate pipeline publish. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a transitive dep of @twurple packages; declared for type resolution, stable false positive. | ai | |
| phantom-deps | phantom-dep:@twurple/eventsub-base | AI (phantom-deps): eventsub-base is a peer/transitive dep; declared for type resolution, stable false positive. | ai |