@valbuild/ui
This package contains Val's UI components and editor interface for content management.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:server/.tmp/assets/index-C6mV7nKj.js | AI (source-diff): Vite/Rollup bundled frontend build output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-C33Q6apG.js | AI (source-diff): Vite/React bundle output, minified not obfuscated; matches package's build pipeline. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BZSASjkd.js | AI (source-diff): Vite-bundled SPA output per build script, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Db1mkq6p.js | AI (source-diff): Minified Vite/React bundle output, not true obfuscation; no malicious behavior found. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DpKnrGno.js | AI (source-diff): Vite-bundled SPA client asset, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DuKOwBys.js | AI (source-diff): Bundled Vite/React build output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Brhy3Wan.js | AI (source-diff): Vite/esbuild bundled client asset, not true obfuscation; consistent with build script. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-QS3_aQFX.js | AI (source-diff): Bundled Vite/React build output, not true obfuscation; no malicious behavior. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-PZHnwCNg.js | AI (source-diff): Vite-bundled SPA asset embedded for server-side serving; minified, not obfuscated. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-CjDxza-F.js | AI (source-diff): Vite-bundled frontend asset, not obfuscation; part of documented build output. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Bo2UQ4nJ.js | AI (source-diff): Standard Vite/React bundled output, not true obfuscation; matches package's UI bundle purpose. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BVXAU8dr.js | AI (source-diff): Vite-bundled SPA asset, minified build output not obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DLQ6N6bW.js | AI (source-diff): Vite/React bundled client asset, not true obfuscation or malicious code. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Long-standing monorepo package, cosmetic metadata gap only. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DTPtfXtu.js | AI (source-diff): Vite/Rollup-bundled frontend asset, not obfuscation; standard build output. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DAdBquPx.js | AI (source-diff): Vite/Rollup bundled SPA asset, not true obfuscation; matches package's UI build output. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-CbTe5pcg.js | AI (source-diff): Vite/React production bundle, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DheHAVve.js | AI (source-diff): Vite/esbuild bundle output (React banner, module preload helpers), not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BCOSuUrp.js | AI (source-diff): Vite bundle output (React app), not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-isFjrIgY.js | AI (source-diff): Bundled Vite/React output, not true obfuscation; consistent with build pipeline. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-C2XIjmwu.js | AI (source-diff): Vite-bundled SPA output, not true obfuscation; matches package's build pipeline. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DIyGXmUv.js | AI (source-diff): Vite-bundled SPA asset (React app), not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-B0jub9fr.js | AI (source-diff): Vite-bundled SPA asset, minified build output not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-ByjTH7HF.js | AI (source-diff): Vite/React build bundle, not true obfuscation; standard SPA asset shipped by this UI package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-B6-kM37D.js | AI (source-diff): Vite/Rollup bundled SPA asset, not true obfuscation; standard build output for this UI package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-xPeLeMI_.js | AI (source-diff): Vite/esbuild bundle output, not obfuscation; standard build artifact for this UI package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-oTAoLk94.js | AI (source-diff): Vite/rollup bundle output for SPA assets, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/patchsets.worker-xgPqyfOB.js | AI (source-diff): Bundled worker file, babel/polyfill helpers not obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/search.worker-wwsaMNHa.js | AI (source-diff): Bundled worker file, babel/polyfill helpers not obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Dj_CIXkO.js | AI (source-diff): Vite-bundled frontend asset, not true obfuscation (standard bundler preamble/React code). | ai | |
| source-diff | net-exec-file:server/.tmp/assets/search.worker-wwsaMNHa.js | AI (source-diff): fetch() call is standard modulepreload polyfill, not dropper behavior. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/validation.worker-CB1ddXtb.js | AI (source-diff): Bundled web worker output, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DP-ZM58p.js | AI (source-diff): Vite bundle output (React + app code), not obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/validation.worker-B_dyvpgr.js | AI (source-diff): Bundled web worker asset, standard build output. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/patchsets.worker-BPh7VqpH.js | AI (source-diff): Bundled web worker asset, standard build output. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/search.worker-CtyOy2oE.js | AI (source-diff): Bundled web worker asset, standard build output. | ai | |
| source-diff | net-exec-file:server/.tmp/assets/search.worker-CtyOy2oE.js | AI (source-diff): Standard Vite modulepreload fetch shim, not exfil behavior. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BzKiNygp.js | AI (source-diff): Vite-bundled SPA asset shipped by a UI server package; minified, not obfuscated. | ai | |
| provenance | missing-githead | AI (provenance): CI-published version with SLSA provenance; gitHead omission is not a compromise indicator here. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-D1crHm4G.js | AI (source-diff): Vite-bundled SPA output for this package's admin UI, not obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/search.worker-BlMohPkR.js | AI (source-diff): Bundled web worker for search feature, minified build output. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BVO5KryB.js | AI (source-diff): Standard Vite bundle output, not true obfuscation; matches build scripts. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Ci-qVKqK.js | AI (source-diff): Vite/Rollup-bundled React app output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-GsNp2f24.js | AI (source-diff): Vite/React bundled build output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-CO7CKULg.js | AI (source-diff): Vite/Rollup bundled build artifact, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-C6HKW0W9.js | AI (source-diff): Vite bundle of client SPA assets embedded for server static serving; minified, not malicious. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DBPPTinq.js | AI (source-diff): Vite/Rollup bundled frontend asset, not obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BhoexnjY.js | AI (source-diff): Vite/esbuild bundled build output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-B98jefCc.js | AI (source-diff): Vite/Rollup bundled SPA output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-B-IlSRE2.js | AI (source-diff): Vite/React bundled build output, not true obfuscation; standard for this package's SPA asset. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-ZAIp-2id.js | AI (source-diff): Vite-bundled client asset, minified not obfuscated; part of documented build pipeline. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-t2OZJYTH.js | AI (source-diff): Vite/esbuild bundled output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DFsMJxzu.js | AI (source-diff): Vite-bundled SPA asset, not obfuscation; consistent with package's static-serving purpose. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-dKlPIr4k.js | AI (source-diff): Vite-bundled SPA asset, long minified lines not true obfuscation. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Um3617EO.js | AI (source-diff): Vite-bundled frontend asset, not true obfuscation. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established long-running library, not a spam package. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-hover-card | AI (phantom-deps): Used via component composition/config, not direct import; official Radix package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-DRTAhP98.js | AI (source-diff): Vite-bundled frontend asset, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/patchsets.worker-CH772rLL.js | AI (source-diff): Vite-minified web worker bundle; standard build artifact. | ai | |
| source-diff | net-exec-file:server/.tmp/assets/search.worker-D5-aGKFO.js | AI (source-diff): Web worker using fetch for search; not a dropper pattern. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/search.worker-D5-aGKFO.js | AI (source-diff): Vite-minified web worker bundle; standard build artifact. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BedkjC1d.js | AI (source-diff): Vite-minified frontend bundle; standard build artifact for a UI server package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BKqzxajW.js | AI (source-diff): Standard Vite-bundled React UI asset; minification is expected for this package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/patchsets.worker-BNtrPoSm.js | AI (source-diff): Standard Vite-bundled web worker asset; minification is expected for this package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-Df7oLDqC.js | AI (source-diff): Standard Vite-bundled minified React app; not obfuscated, just minified build output. | ai | |
| source-diff | encoded-string-file:server/dist/valbuild-ui-server.cjs.js | AI (source-diff): Base64 encoding of the minified UI bundle for inline asset serving; benign pattern for this package. | ai | |
| source-diff | encoded-string-file:server/dist/valbuild-ui-server.esm.js | AI (source-diff): Same base64-inlined asset pattern as CJS build; stable and benign for this package. | ai | |
| source-diff | obfuscated-file:server/.tmp/assets/index-BsP50hgv.js | AI (source-diff): Standard Vite-minified React bundle; not obfuscated, just minified UI assets. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped @valbuild org package; Levenshtein match to pg is a false positive. | ai | |
| phantom-deps | phantom-dep:@tanstack/react-virtual | AI (phantom-deps): UI packages commonly reference deps in config without direct imports; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped @valbuild org package; Levenshtein match to yup is a false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @valbuild org package; Levenshtein match to joi is a false positive. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped @valbuild org package; Levenshtein match to qs is a false positive. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped @valbuild org package; Levenshtein match to uuid is a false positive with no naming similarity. | ai |
Versions (showing 84 of 84)
| Version | Deps | Published |
|---|---|---|
| 0.97.3 | 0 / 128 | |
| 0.97.2 | 0 / 128 | |
| 0.97.1 | 0 / 128 | |
| 0.97.0 | 0 / 128 | |
| 0.96.3 | 0 / 127 | |
| 0.96.2 | 0 / 127 | |
| 0.96.1 | 1 / 126 | |
| 0.96.0 | 1 / 126 | |
| 0.95.0 | 1 / 126 | |
| 0.94.0 | 1 / 125 | |
| 0.93.0 | 0 / 125 | |
| 0.92.1 | 0 / 125 | |
| 0.92.0 | 0 / 125 | |
| 0.91.4 | 0 / 119 | |
| 0.91.3 | 0 / 119 | |
| 0.91.2 | 0 / 119 | |
| 0.91.1 | 0 / 107 | |
| 0.91.0 | 0 / 107 | |
| 0.90.0 | 0 / 107 | |
| 0.89.0 | 0 / 105 | |
| 0.88.0 | 0 / 105 | |
| 0.87.5 | 0 / 105 | |
| 0.87.4 | 1 / 84 | |
| 0.87.3 | 1 / 84 | |
| 0.74.0 | 1 / 83 | |
| 0.73.2 | 1 / 83 | |
| 0.73.1 | 1 / 83 | |
| 0.73.0 | 1 / 83 | |
| 0.72.4 | 1 / 83 | |
| 0.72.3 | 1 / 83 | |
| 0.72.2 | 1 / 83 | |
| 0.72.1 | 1 / 83 | |
| 0.72.0 | 1 / 83 | |
| 0.69.3 | 1 / 83 | |
| 0.69.2 | 1 / 83 | |
| 0.69.1 | 1 / 83 | |
| 0.69.0 | 1 / 83 | |
| 0.68.2 | 0 / 83 | |
| 0.68.1 | 0 / 83 | |
| 0.68.0 | 0 / 83 | |
| 0.67.1 | 0 / 83 | |
| 0.67.0 | 0 / 83 | |
| 0.66.0 | 0 / 83 | |
| 0.65.3 | 0 / 83 | |
| 0.65.2 | 0 / 83 | |
| 0.65.0 | 0 / 83 | |
| 0.64.0 | 0 / 81 | |
| 0.63.6 | 0 / 80 | |
| 0.63.5 | 0 / 80 | |
| 0.63.1 | 0 / 80 | |
| 0.63.0 | 0 / 80 | |
| 0.62.6 | 0 / 80 | |
| 0.62.5 | 0 / 80 | |
| 0.62.4 | 0 / 80 | |
| 0.62.3 | 0 / 80 | |
| 0.62.2 | 0 / 79 | |
| 0.62.1 | 0 / 79 | |
| 0.62.0 | 0 / 79 | |
| 0.61.0 | 0 / 79 | |
| 0.60.27 | 0 / 79 | |
| 0.60.24 | 0 / 79 | |
| 0.60.23 | 0 / 79 | |
| 0.60.22 | 0 / 79 | |
| 0.60.21 | 0 / 79 | |
| 0.60.20 | 0 / 79 | |
| 0.60.19 | 0 / 79 | |
| 0.60.18 | 0 / 81 | |
| 0.60.17 | 0 / 81 | |
| 0.60.16 | 0 / 81 | |
| 0.60.15 | 0 / 81 | |
| 0.60.14 | 0 / 81 | |
| 0.60.13 | 0 / 81 | |
| 0.60.12 | 0 / 81 | |
| 0.60.11 | 0 / 81 | |
| 0.60.10 | 0 / 81 | |
| 0.60.9 | 0 / 81 | |
| 0.60.8 | 0 / 81 | |
| 0.60.7 | 0 / 81 | |
| 0.60.6 | 0 / 81 | |
| 0.60.5 | 0 / 81 | |
| 0.60.4 | 0 / 81 | |
| 0.60.3 | 0 / 81 | |
| 0.60.2 | 0 / 81 | |
| 0.60.1 | 0 / 82 |
v0.97.3
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.93.0
5 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-03-25, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.92.1
5 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-30, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.92.0
5 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-30, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.91.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.91.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.91.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-14, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.91.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.91.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.90.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.89.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-10, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.88.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2026-01-10, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.87.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2025-12-26, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.87.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (freekh) on 2025-12-26, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.87.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.74.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.73.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.73.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.73.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.72.4
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.72.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.72.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.72.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.72.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.69.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.69.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.69.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.69.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.68.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.68.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.68.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.67.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.67.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.66.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.65.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.65.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.65.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.64.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.63.6
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.63.5
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.63.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.63.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.6
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.5
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.4
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.62.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.61.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.