@twinfinity/core
Makes it possible to host (and interact) with Twinfinity in an HTML page
4
Versions
ISC
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
sejjzj
Keywords
bimviewertwinfinityembedded
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/lines/renderer/shaders.d.ts | AI (source-diff): Long lines are inline GLSL shader source in a TypeScript declaration file — legitimate pattern for this 3D viewer package. | ai | |
| source-diff | encoded-string-file:docs/assets/hierarchy.js | AI (source-diff): TypeDoc-generated navigation/search data; base64-compressed JSON is standard for this toolchain. | ai | |
| source-diff | encoded-string-file:docs/assets/navigation.js | AI (source-diff): TypeDoc-generated navigation data; long encoded string is compressed JSON, not a payload. | ai | |
| source-diff | encoded-string-file:docs/assets/search.js | AI (source-diff): TypeDoc-generated search index; long encoded string is compressed JSON, not a payload. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped BIM viewer package with 49 versions; no relation to the cors package — stable false positive. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Standard Proxy trap forwarding via Reflect.get(); not obfuscation — stable pattern for this package. | ai |