@subnoto/api-client — Greenflagged

TypeScript SDK for Subnoto Public API

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

tidalfmikescops

subnotoapiclienttypescript

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:index.cjs	AI (source-diff): index.cjs is a standard minified bundler output (esbuild/rollup) for this TypeScript SDK; not obfuscation.	ai	2026/05/04
source-diff	net-exec-file:index.cjs	AI (source-diff): Network calls (openapi-fetch HTTP client) + new Function() in minified bundle are legitimate SDK patterns, not dropper behavior.	ai	2026/05/04
semgrep	semgrep:base64-decode	AI (semgrep): Fires in bundled ASN.1/PEM parser (unarmor method + base64 table); standard crypto parsing pattern, not malicious.	ai	2026/05/04
phantom-deps	phantom-dep:tough-cookie	AI (phantom-deps): tough-cookie is declared as a runtime dependency; phantom-dep heuristic false positive for this package.	ai	2026/05/04
semgrep	semgrep:hex-decode	AI (semgrep): Fires in minified bundle from bundled crypto/ASN.1 dependency; not malicious payload encoding.	ai	2026/04/29
semgrep	semgrep:new-function-constructor	AI (semgrep): Fires in minified bundle from bundled dependency; consistent with parser/template patterns in openapi-fetch or tough-cookie.	ai	2026/04/29

View all versions

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.