@signalk/freeboard-sk
Openlayers chart plotter implementation for Signal K
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:public/main-GWT4XTZZ.js | AI (source-diff): Bundled Angular build output, not true obfuscation. | ai | |
| phantom-deps | phantom-dep:remark-parse | AI (phantom-deps): Used by new markdown feature build scripts, likely bundled. | ai | |
| phantom-deps | phantom-dep:signalk-plotterext-bus | AI (phantom-deps): New plotter integration dep, likely referenced via bundled config. | ai | |
| phantom-deps | phantom-dep:remark-gfm | AI (phantom-deps): Used by new markdown feature build scripts, likely bundled. | ai | |
| phantom-deps | phantom-dep:unified | AI (phantom-deps): Used by new markdown feature build scripts, likely bundled. | ai | |
| source-diff | obfuscated-file:public/worker-4MQD26BS.js | AI (source-diff): Bundled web-worker build output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:public/worker-FPJG6QKK.js | AI (source-diff): Bundled worker output, standard geo libs, not obfuscation. | ai | |
| source-diff | net-exec-file:public/worker-42LKK6ER.js | AI (source-diff): Closure library's script-loader eval, not a dropper. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in rxjs/Angular bundle code, benign pattern. | ai | |
| source-diff | obfuscated-file:public/main-SF5NH7GR.js | AI (source-diff): Bundled Angular/webpack build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:public/worker-42LKK6ER.js | AI (source-diff): Bundled worker output including Closure runtime, not malicious. | ai | |
| source-diff | obfuscated-file:public/worker-WYOFLVNH.js | AI (source-diff): Bundled worker output (xml2js etc.). | ai | |
| source-diff | obfuscated-file:public/main-6U2EOOC2.js | AI (source-diff): Angular/esbuild bundle output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:public/worker-2PB26N5U.js | AI (source-diff): Bundled worker output for map rendering. | ai | |
| source-diff | obfuscated-file:public/worker-UZNU4LIJ.js | AI (source-diff): Bundled worker output (xml2js etc.). | ai | |
| source-diff | obfuscated-file:public/worker-6R7HGCES.js | AI (source-diff): Bundled worker chunk, minified build output. | ai | |
| source-diff | obfuscated-file:public/main-3CX2DAQ4.js | AI (source-diff): esbuild-bundled Angular frontend output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:public/main-OMRQ4FBK.js | AI (source-diff): Bundled Angular build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:public/main-AZEF35BN.js | AI (source-diff): Angular/esbuild bundle output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:public/worker-Y35X2QU7.js | AI (source-diff): Bundled web-worker output (closure lib), not obfuscation. | ai | |
| source-diff | net-exec-file:public/worker-Y35X2QU7.js | AI (source-diff): Bundled worker JS; no dropper/loader behavior found in code. | ai | |
| provenance | publisher-changed | AI (provenance): Manual to CI/CD-attested transition; improvement not compromise. | ai | |
| source-diff | obfuscated-file:public/main-ZOI63BYP.js | AI (source-diff): Webpack/esbuild bundled Angular app output, not true obfuscation. | ai | |
| source-diff | net-exec-file:public/worker-XLDLGEWQ.js | AI (source-diff): Webworker bundle using goog namespace loader, not a dropper. | ai | |
| source-diff | obfuscated-file:public/worker-VGUT3EU7.js | AI (source-diff): Minified bundle, same build pipeline. | ai | |
| source-diff | obfuscated-file:public/worker-JWBESAJK.js | AI (source-diff): Minified Closure-based webworker bundle, standard build artifact. | ai | |
| source-diff | obfuscated-file:public/main-LF4KQTMA.js | AI (source-diff): Bundled Angular/OpenLayers build output, not true obfuscation. | ai | |
| source-diff | net-exec-file:public/worker-JWBESAJK.js | AI (source-diff): Webworker bundle using goog namespace loader, not a dropper. | ai | |
| source-diff | obfuscated-file:public/worker-XLDLGEWQ.js | AI (source-diff): Minified bundle, same build pipeline. | ai | |
| source-diff | obfuscated-file:public/main-HJRTSPY2.js | AI (source-diff): Angular/esbuild bundled build output, not true obfuscation. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Long-tenured publisher with strong track record; normal maintainer list churn. | ai | |
| source-diff | obfuscated-file:public/main-YREPE7Q3.js | AI (source-diff): Bundled Angular/esbuild output, not obfuscation. | ai | |
| source-diff | obfuscated-file:public/worker-ZBHAEDRF.js | AI (source-diff): Bundled esbuild worker output, not obfuscation. | ai | |
| source-diff | net-exec-file:public/chunk-AZK5ODAA.js | AI (source-diff): Bundled Worker + async generator polyfill in Angular build output; not a dropper pattern for this package. | ai | |
| source-diff | obfuscated-file:public/worker-V6HMSEDU.js | AI (source-diff): Angular production build worker bundle; minification is expected for this package. | ai | |
| source-diff | obfuscated-file:public/main-YHMZXR5G.js | AI (source-diff): Angular production build output; minified bundles with hashed names are expected for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires in Angular production bundle; standard build artifact pattern, not a payload. | ai | |
| phantom-deps | phantom-dep:google-protobuf | AI (phantom-deps): google-protobuf is a runtime dep used via generated protobuf code; phantom-dep heuristic is a false positive here. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Eval in worker bundle is Google Closure Compiler's dependency loader pattern, not malicious. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 9 / 50 | |
| 2.24.2 | 5 / 50 | |
| 2.24.1 | 5 / 50 | |
| 2.24.0 | 5 / 50 | |
| 2.23.0 | 5 / 50 | |
| 2.22.1 | 5 / 48 | |
| 2.22.0 | 5 / 48 | |
| 2.21.0 | 5 / 48 | |
| 2.20.0 | 5 / 48 | |
| 2.19.9 | 5 / 52 | |
| 2.19.8 | 5 / 52 | |
| 2.19.7 | 5 / 51 | |
| 2.19.6 | 4 / 51 | |
| 2.19.5 | 3 / 52 | |
| 2.19.4 | 3 / 51 | |
| 2.19.3 | 3 / 51 | |
| 2.19.2 | 3 / 51 |
v3.0.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.24.2
8 findingsThis version was published by a different npm account than previous versions on 2026-06-24. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.20.0
9 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.9
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.8
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.7
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.6
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.19.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.19.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.