@twick/visualizer — Greenflagged

A visualization library built on top of [@twick/2d](https://github.com/re-video/2d) for creating interactive visualizations and animations.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ncounterspecialistanujkanojia29

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase reflects bundling dependencies into dist via vite build; consistent with added prepublishOnly script.	ai	2026/05/09
source-diff	net-exec-file:dist/project.js	AI (source-diff): Network calls and dynamic execution in a visualizer bundle are expected UI/renderer patterns, not dropper behavior.	ai	2026/05/09
source-diff	obfuscated-file:dist/project.js	AI (source-diff): dist/project.js is a standard vite-bundled minified output; long lines are normal for bundled JS, not obfuscation.	ai	2026/05/09
phantom-deps	phantom-dep:@revideo/renderer	AI (phantom-deps): Referenced in config files only, not directly imported; consistent with build tooling pattern for this package.	ai	2026/05/09
source-diff	encoded-string-file:dist/project.js	AI (source-diff): Long strings are GLSL shader fragments and effect configs; expected for a visualizer bundle.	ai	2026/05/02
phantom-deps	phantom-dep:@twick/vite-plugin	AI (phantom-deps): Same-org monorepo dep; stable false positive.	ai	2026/05/02
phantom-deps	phantom-dep:@twick/media-utils	AI (phantom-deps): Same-org sibling dep; indirect usage pattern is stable for this monorepo package.	ai	2026/05/02
phantom-deps	phantom-dep:@twick/renderer	AI (phantom-deps): Same-org sibling dep; indirect usage via re-export or config is expected for this monorepo package.	ai	2026/05/02
phantom-deps	phantom-dep:@preact/signals	AI (phantom-deps): Signals used via config/bundler aliasing in visualizer; stable false positive for this package.	ai	2026/05/02
phantom-deps	phantom-dep:preact	AI (phantom-deps): Preact used as peer/bundler target in visualizer UI; indirect usage pattern is stable for this package.	ai	2026/05/02
phantom-deps	phantom-dep:crelt	AI (phantom-deps): UI library dependency likely used via bundler/config aliasing, not direct import; stable false positive for this package.	ai	2026/05/02

Versions (showing 49 of 49)

Version	Deps	Published
0.15.31	10 / 7	2026-05-07
0.15.30	10 / 7	2026-04-25
0.15.29	10 / 7	2026-04-16
0.15.28	10 / 7	2026-04-10
0.15.25	10 / 7	2026-03-11
0.15.24	10 / 7	2026-03-09
0.15.23	10 / 7	2026-03-05
0.15.22	10 / 7	2026-02-28
0.15.21	10 / 7	2026-02-27
0.15.20	9 / 7	2026-02-24
0.15.19	9 / 7	2026-02-17
0.15.18	9 / 7	2026-02-16
0.15.16	9 / 7	2026-02-13
0.15.15	9 / 7	2026-02-11
0.15.14	9 / 7	2026-02-08
0.15.13	9 / 7	2026-02-05
0.15.12	9 / 7	2026-02-01
0.15.11	9 / 7	2026-01-31
0.15.10	9 / 7	2026-01-31
0.15.9	9 / 7	2026-01-28
0.15.8	9 / 7	2026-01-27
0.15.7	9 / 7	2026-01-23
0.15.6	9 / 7	2026-01-22
0.15.5	9 / 7	2026-01-22
0.15.4	9 / 7	2026-01-21
0.15.3	9 / 7	2026-01-19
0.15.2	9 / 7	2026-01-15
0.15.1	9 / 7	2026-01-08
0.15.0	9 / 7	2026-01-07
0.14.20	9 / 7	2026-01-06
0.14.18	9 / 7	2026-01-04
0.14.17	9 / 7	2025-12-29
0.14.16	9 / 7	2025-12-21
0.14.15	9 / 7	2025-12-18
0.14.14	9 / 7	2025-12-13
0.14.13	9 / 7	2025-12-09
0.14.12	9 / 7	2025-12-08
0.14.11	9 / 7	2025-11-12
0.14.10	9 / 7	2025-11-09
0.14.9	9 / 7	2025-11-08
0.14.8	9 / 7	2025-11-07
0.14.7	9 / 7	2025-10-09
0.14.6	9 / 7	2025-10-01
0.14.5	9 / 7	2025-09-25
0.14.4	9 / 7	2025-09-12
0.14.3	9 / 7	2025-08-29
0.14.2	9 / 7	2025-08-19
0.14.0	9 / 7	2025-08-04
0.0.1	9 / 7	2025-06-04

v0.15.31

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.30

2 findings

HIGH Long encoded string in modified file: dist/project.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.29

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.24

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.20

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.18

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.17

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.16

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.15

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.14

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.13

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.12

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.11

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.10

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.9

3 findings

HIGH New obfuscated file: dist/project.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/project.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.