@steedos/webapp
Steedos WebApp 是一个基于 React 的 Web 应用程序，用于展示和管理 Steedos 应用程序的数据。替代了 Steedos 2.x 中的 Meteor Clint。
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/assets/index-D1UMGXOo.js | AI (source-diff): Vite bundle output containing modulepreload polyfill; not a dropper. | ai | |
| source-diff | net-exec-file:dist/assets/index-BJZiVewG.js | AI (source-diff): Vite bundle output containing standard modulepreload polyfill; not malicious code. | ai | |
| source-diff | net-exec-file:dist/assets/index-Di2dwtoU.js | AI (source-diff): Vite modulepreload polyfill in bundled build output, not a loader/dropper. | ai | |
| source-diff | net-exec-file:dist/assets/index-D1Qod7S1.js | AI (source-diff): Vite build bundle; sample is standard modulepreload polyfill, not malicious exec. | ai | |
| source-diff | obfuscated-file:dist/assets/index-CJty8bMw.js | AI (source-diff): Vite-bundled frontend asset, not true obfuscation; long lines are minification. | ai | |
| source-diff | net-exec-file:dist/assets/index-CJty8bMw.js | AI (source-diff): Bundled SPA using fetch/socket.io/dynamic imports, not a dropper. | ai | |
| source-diff | net-exec-file:dist/assets/index-CIjj35sk.js | AI (source-diff): Vite-bundled app output, not obfuscated malware; sample shows standard modulepreload polyfill. | ai | |
| source-diff | net-exec-file:dist/assets/index-DXe8lj55.js | AI (source-diff): Vite-bundled SPA output, not obfuscated/malicious code. | ai | |
| source-diff | net-exec-file:dist/assets/index-BLqbzxYm.js | AI (source-diff): Vite-bundled frontend asset (modulepreload polyfill), not a loader/dropper. | ai | |
| source-diff | net-exec-file:dist/assets/index-D-MR1qT9.js | AI (source-diff): Vite-bundled frontend app; network+eval pattern is standard browser module preload polyfill, not malware. | ai | |
| phantom-deps | phantom-dep:autoprefixer | AI (phantom-deps): autoprefixer is a CSS build tool referenced in vite/tailwind config, not directly imported — stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@steedos-widgets/amis-object | AI (phantom-deps): Scoped dep from same org, referenced in config files; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 3.0.14 | 2 / 57 | |
| 3.0.13 | 2 / 57 | |
| 3.0.12 | 2 / 57 | |
| 3.0.11 | 2 / 57 | |
| 3.0.10 | 2 / 57 | |
| 3.0.9 | 2 / 57 | |
| 3.0.8 | 2 / 56 | |
| 3.0.7 | 2 / 56 | |
| 3.0.6 | 2 / 56 | |
| 3.0.4 | 1 / 56 | |
| 3.0.3 | 1 / 57 | |
| 3.0.2 | 0 / 57 | |
| 3.0.1 | 0 / 57 | |
| 3.0.0 | 0 / 57 |
v3.0.12
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.11
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.10
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.9
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.8
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.7
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.6
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.4
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.3
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.