@swissquote/crafty-runner-webpack
Webpack is an asset bundler, its purpose is to compile your JavaScript code to be the most efficient possible for production.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:webpack-chain-5 | AI (dependencies): Legitimate webpack config helper library, expected for this runner package. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Long-lived publish by known co-maintainer per provenance INFO note, not a real takeover. | ai | |
| source-diff | obfuscated-file:dist/compiled/sourcemap-register.js | AI (source-diff): Standard minified sourcemap-register bundler helper, not obfuscation. | ai | |
| provenance | missing-githead | AI (provenance): Minor publish metadata gap on an old, consistently trusted publisher; not tampering evidence. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is a standard webpack tooling package matching module's purpose. | ai | |
| source-diff | obfuscated-file:dist/packages-webpack/sourcemap-register.js | AI (source-diff): Minified source-map-support registration shim; well-known pattern, not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/packages-webpack/bundled.js | AI (source-diff): Standard ncc/webpack bundle artifact; webpackBootstrap pattern confirms legitimate bundled output, not dropper malware. | ai | |
| phantom-deps | phantom-dep:@swissquote/crafty | AI (phantom-deps): Same-org sibling declared as peer/runtime dep; phantom-dep heuristic is a false positive here. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Pattern is a documented user-config merge in a build tool; stable across versions of this package. | ai |
Versions (showing 39 of 39)
| Version | Deps | Published |
|---|---|---|
| 1.30.1 | 8 / 13 | |
| 1.30.0 | 8 / 13 | |
| 1.29.0 | 8 / 13 | |
| 1.28.1 | 9 / 13 | |
| 1.24.0 | 9 / 13 | |
| 1.22.2 | 9 / 13 | |
| 1.22.0 | 9 / 13 | |
| 1.17.2 | 15 / 2 | |
| 1.17.1 | 15 / 2 | |
| 1.16.3 | 15 / 2 | |
| 1.16.1 | 15 / 2 | |
| 1.16.0 | 15 / 2 | |
| 1.13.7 | 17 / 2 | |
| 1.13.5 | 17 / 2 | |
| 1.13.4 | 17 / 2 | |
| 1.13.3 | 17 / 2 | |
| 1.13.2 | 17 / 2 | |
| 1.13.0 | 17 / 2 | |
| 1.12.0 | 16 / 2 | |
| 1.11.1 | 16 / 2 | |
| 1.11.0 | 16 / 2 | |
| 1.10.0 | 16 / 2 | |
| 1.9.1 | 16 / 2 | |
| 1.9.0 | 16 / 2 | |
| 1.8.0 | 16 / 2 | |
| 1.7.3 | 16 / 2 | |
| 1.7.2 | 16 / 2 | |
| 1.7.1 | 16 / 2 | |
| 1.7.0 | 16 / 2 | |
| 1.6.0 | 17 / 4 | |
| 1.5.0 | 14 / 1 | |
| 1.4.0 | 13 / 1 | |
| 1.3.0 | 13 / 1 | |
| 1.2.1 | 13 / 1 | |
| 1.2.0 | 13 / 1 | |
| 1.1.0 | 13 / 0 | |
| 1.0.2 | 12 / 0 | |
| 1.0.1 | 11 / 0 | |
| 1.0.0 | 11 / 0 |
v1.24.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2023-12-19, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.22.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2023-04-24, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.22.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2023-04-13, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.17.2
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-11-01, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.17.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-29, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.16.3
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-13, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.16.1
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-12, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.16.0
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: stephane.goetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (stephane.goetz) than the most recent previously approved version (onigoetz) on 2021-10-06, but stephane.goetz is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.13.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.5
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: onigoetz.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.