← Home

@turbo/workspaces

npm Repository Homepage

Tools for working with package managers

76
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/convert-C-_uy9dr.mjs AI (source-diff): Bundled minified build output (tsdown/esbuild), not true obfuscation. ai
source-diff obfuscated-file:dist/convert-DHptCX32.js AI (source-diff): Bundled minified build output, not true obfuscation. ai
source-diff net-exec-file:dist/convert-C-_uy9dr.mjs AI (source-diff): CLI tool bundling execa/fs for legitimate workspace conversion; no hostile destination. ai
source-diff net-exec-file:dist/convert-DHptCX32.js AI (source-diff): CLI tool bundling execa/fs for legitimate workspace conversion; no hostile destination. ai
source-diff net-exec-file:dist/chunk-RIIPC7UD.mjs AI (source-diff): tsup/esbuild bundle boilerplate (dynamic-require shim); not a dropper. Stable build artifact. ai
source-diff net-exec-file:dist/chunk-ALJ25SZ4.mjs AI (source-diff): tsup/esbuild bundled output with standard require-proxy banner; not obfuscation or a loader. ai
source-diff net-exec-file:dist/chunk-WZOVIFMN.mjs AI (source-diff): tsup/esbuild-bundled chunk with standard dynamic-require shim; no malicious behavior. ai
phantom-deps phantom-dep:rimraf AI (phantom-deps): rimraf used in config/build, stable FP for this package. ai
source-diff net-exec-file:dist/chunk-54EAMFL5.mjs AI (source-diff): tsup/esbuild bundled build output for legit Vercel package; require-shim is bundler artifact, not a dropper. ai
source-diff net-exec-file:dist/convert-D5eeCKcP.js AI (source-diff): net+exec from bundled execa/fs deps in a workspace CLI tool; benign. ai
source-diff net-exec-file:dist/convert-Bdm99LFE.mjs AI (source-diff): net+exec from bundled deps; benign for this package. ai
source-diff obfuscated-file:dist/convert-Bdm99LFE.mjs AI (source-diff): ESM bundle of same source; minified build artifact. ai
source-diff obfuscated-file:dist/convert-D5eeCKcP.js AI (source-diff): tsdown-bundled dist output, not obfuscation; official turborepo package. ai
source-diff net-exec-file:dist/convert-B_6DBHyo.mjs AI (source-diff): Same bundled CLI; execa/update-check are stated function, benign. ai
source-diff obfuscated-file:dist/convert-B_6DBHyo.mjs AI (source-diff): ESM twin of same tsdown bundle; minified build output, not obfuscation. ai
source-diff net-exec-file:dist/convert-D-3XNokE.js AI (source-diff): execa/update-check in a bundled CLI; no hostile destination, expected for workspace tooling. ai
source-diff obfuscated-file:dist/convert-D-3XNokE.js AI (source-diff): tsdown-bundled CLI output, not obfuscation; standard-import bundle for official turborepo package. ai
source-diff obfuscated-file:dist/convert-B_I_N-ag.js AI (source-diff): tsdown/esbuild-bundled CLI output, not obfuscation. ai
source-diff net-exec-file:dist/convert-B_VMdyOZ.mjs AI (source-diff): execa/update-check in bundled CLI; first-party turbo tool. ai
source-diff obfuscated-file:dist/convert-B_VMdyOZ.mjs AI (source-diff): Bundled ESM build output from tsdown. ai
source-diff net-exec-file:dist/convert-B_I_N-ag.js AI (source-diff): execa/update-check in bundled CLI; first-party turbo tool. ai
source-diff obfuscated-file:dist/convert-C5maMirZ.mjs AI (source-diff): ESM variant of the same tsdown bundle; same rationale as CJS counterpart. ai
source-diff net-exec-file:dist/convert-C5maMirZ.mjs AI (source-diff): Same as CJS counterpart; ESM bundle of the same legitimate code. ai
source-diff net-exec-file:dist/convert-C2pzdHW1.js AI (source-diff): Network usage is update-check (version check); no dynamic code execution pattern visible in samples. ai
source-diff obfuscated-file:dist/convert-C2pzdHW1.js AI (source-diff): Minified tsdown bundle output; content matches declared deps, no obfuscation indicators beyond minification. ai
source-diff obfuscated-file:dist/convert-D4C-1Ajd.mjs AI (source-diff): ESM variant of the same tsdown bundle; same benign pattern. ai
source-diff net-exec-file:dist/convert-D4C-1Ajd.mjs AI (source-diff): ESM variant; network/exec from bundled update-check/execa, not malicious. ai
source-diff obfuscated-file:dist/convert-tgaQ3xBy.js AI (source-diff): Standard tsdown/rollup minified bundle output; imports match declared deps. ai
source-diff net-exec-file:dist/convert-tgaQ3xBy.js AI (source-diff): Network/exec pattern is from bundled update-check and execa deps, not malicious dropper. ai
source-diff obfuscated-file:dist/convert-DMWl-kFW.mjs AI (source-diff): Standard tsdown/rollup minified ESM bundle; not obfuscated malware. ai
source-diff obfuscated-file:dist/convert-C2QjcU-1.js AI (source-diff): Standard tsdown/rollup minified bundle output; not obfuscated malware. ai
source-diff net-exec-file:dist/convert-C2QjcU-1.js AI (source-diff): Network/exec patterns are from bundled deps (execa, update-check) in normal build output. ai
source-diff net-exec-file:dist/convert-DMWl-kFW.mjs AI (source-diff): Network/exec patterns are from bundled deps (execa, update-check) in normal build output. ai
source-diff obfuscated-file:dist/convert-DZTyk3Od.js AI (source-diff): Standard tsdown bundle output; all imports are declared legitimate deps. ai
source-diff net-exec-file:dist/convert-9DAWjfTd.mjs AI (source-diff): Network/exec pattern is from bundled execa/update-check deps, not malware. ai
source-diff obfuscated-file:dist/convert-9DAWjfTd.mjs AI (source-diff): Standard tsdown ESM bundle output; same legitimate dep set. ai
source-diff net-exec-file:dist/convert-DZTyk3Od.js AI (source-diff): Network/exec pattern is from bundled execa/update-check deps, not malware. ai
source-diff obfuscated-file:dist/convert-K_QAsCNE.js AI (source-diff): Standard tsdown/rollup bundle output; all imports are declared deps, no malicious patterns. ai
source-diff net-exec-file:dist/convert-CPHQWSyu.mjs AI (source-diff): ESM variant of the same bundle; same analysis applies. ai
source-diff obfuscated-file:dist/convert-CPHQWSyu.mjs AI (source-diff): ESM variant of the same bundle; same analysis applies. ai
source-diff net-exec-file:dist/convert-K_QAsCNE.js AI (source-diff): Network calls are update-check; code execution is execa for package manager commands — both declared deps, expected behavior. ai
source-diff net-exec-file:dist/chunk-2WSM2AFM.mjs AI (source-diff): Standard tsup/esbuild bundle; network calls come from bundled deps (update-check, execa) — not malicious dropper behavior. ai
source-diff net-exec-file:dist/chunk-6E4Q5G24.mjs AI (source-diff): Bundled tsup/esbuild output for a CLI tool; dynamic require and network calls are part of the package's legitimate update-check and package-manager detection functionality. ai
source-diff source-size-tripled AI (source-diff): Size increase consistent with new chunk file added in build refactor; SLSA provenance confirms CI/CD build integrity. ai
source-diff encoded-string-file:dist/index.js AI (source-diff): Minified bundle output from tsup; encoded strings are standard build artifacts for this package. ai
source-diff encoded-string-file:dist/cli.js AI (source-diff): Minified bundle output from tsup; encoded strings are standard build artifacts for this package. ai
source-diff net-exec-file:dist/chunk-Y2U4B22G.mjs AI (source-diff): Standard tsup/esbuild bundle output; code sample shows typical module boilerplate, not dropper malware. ai
provenance publisher-changed AI (provenance): Vercel turborepo migrated publishing to GitHub Actions CI/CD with SLSA provenance; stable pattern for this org. ai
phantom-deps phantom-dep:execa AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:@inquirer/prompts AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:gradient-string AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:update-check AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:picocolors AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:fast-glob AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:commander AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:fs-extra AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:js-yaml AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:semver AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai
phantom-deps phantom-dep:ora AI (phantom-deps): CLI tool; dependencies used via config or indirect imports, not direct require/import. ai

Versions (showing 76 of 76)

Version Deps Published
2.10.7 11 / 13
2.10.6 11 / 13
2.10.5 11 / 13
2.10.4 11 / 13
2.10.3 11 / 13
2.10.2 11 / 13
2.10.1 11 / 13
2.10.0 11 / 13
2.9.18 11 / 13
2.9.17 11 / 13
2.9.16 11 / 13
2.9.15 11 / 13
2.9.14 11 / 13
2.9.12 11 / 13
2.9.11 11 / 13
2.9.10 11 / 13
2.9.9 11 / 13
2.9.8 11 / 13
2.9.7 11 / 13
2.9.6 11 / 13
2.9.5 11 / 13
2.9.4 11 / 13
2.9.3 11 / 13
2.9.2 11 / 13
2.9.1 11 / 13
2.9.0 11 / 13
2.8.21 11 / 13
2.8.20 11 / 13
2.8.19 11 / 13
2.8.18 11 / 13
2.8.17 11 / 13
2.8.16 11 / 13
2.8.4 11 / 13
2.8.1 11 / 14
2.8.0 11 / 14
2.7.6 11 / 14
2.7.5 11 / 14
2.7.4 11 / 14
2.7.3 11 / 15
2.7.2 11 / 15
2.6.3 11 / 15
2.6.2 11 / 15
2.6.1 11 / 15
2.5.8 11 / 15
2.5.7 11 / 15
2.5.6 11 / 15
2.5.5 11 / 15
2.5.4 11 / 15
2.5.3 11 / 15
2.3.3 11 / 15
2.3.2 11 / 15
2.3.1 12 / 17
2.3.0 12 / 17
2.2.3 12 / 18
2.2.2 12 / 18
2.2.1 12 / 18
2.2.0 12 / 18
2.1.3 12 / 18
2.1.2 12 / 18
2.1.1 12 / 18
2.1.0 12 / 18
2.0.14 12 / 18
2.0.13 12 / 18
2.0.12 12 / 18
2.0.11 12 / 18
2.0.10 12 / 18
2.0.9 12 / 18
2.0.8 12 / 18
2.0.7 12 / 18
2.0.6 12 / 19
2.0.5 12 / 19
2.0.4 12 / 19
2.0.3 12 / 19
2.0.2 12 / 19
2.0.1 12 / 19
2.0.0 12 / 19

v2.10.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.6

5 findings
HIGH New obfuscated file: dist/convert-C-_uy9dr.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-C-_uy9dr.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/convert-DHptCX32.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-DHptCX32.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.5

5 findings
HIGH New obfuscated file: dist/convert-B_I_N-ag.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_I_N-ag.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/convert-B_VMdyOZ.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_VMdyOZ.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.4

5 findings
HIGH New obfuscated file: dist/convert-B_I_N-ag.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_I_N-ag.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/convert-B_VMdyOZ.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_VMdyOZ.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.3

5 findings
HIGH New obfuscated file: dist/convert-B_I_N-ag.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_I_N-ag.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/convert-B_VMdyOZ.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_VMdyOZ.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.2

5 findings
HIGH New obfuscated file: dist/convert-D5eeCKcP.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-D5eeCKcP.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/convert-Bdm99LFE.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-Bdm99LFE.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.10.1

5 findings
HIGH New obfuscated file: dist/convert-D-3XNokE.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-D-3XNokE.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/convert-B_6DBHyo.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/convert-B_6DBHyo.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.3

2 findings
HIGH New file with network + code execution: dist/chunk-RIIPC7UD.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.2

2 findings
HIGH New file with network + code execution: dist/chunk-RIIPC7UD.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

2 findings
HIGH New file with network + code execution: dist/chunk-RIIPC7UD.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

2 findings
HIGH New file with network + code execution: dist/chunk-RIIPC7UD.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.3

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.2

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.1

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.3

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.2

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

2 findings
HIGH New file with network + code execution: dist/chunk-ALJ25SZ4.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.14

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.13

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.12

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.11

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.10

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.9

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.8

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.7

2 findings
HIGH New file with network + code execution: dist/chunk-WZOVIFMN.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.6

2 findings
HIGH New file with network + code execution: dist/chunk-54EAMFL5.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.5

2 findings
HIGH New file with network + code execution: dist/chunk-54EAMFL5.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.4

2 findings
HIGH New file with network + code execution: dist/chunk-54EAMFL5.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.3

2 findings
HIGH New file with network + code execution: dist/chunk-54EAMFL5.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.2

2 findings
HIGH New file with network + code execution: dist/chunk-54EAMFL5.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.