@vc-shell/framework
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/chunks/VcAiAgentPanel.vue_vue_type_style_index_0_lang-CTHTF63Q.js | AI (source-diff): Standard Vite-minified Vue component chunk; readable imports and class definitions confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/chunks/VcAiAgentPanel.vue_vue_type_style_index_0_lang-D5HgEXFw.js | AI (source-diff): Standard minified Vue SFC bundle chunk; long lines are build output, not obfuscation. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Major version rewrite with new UI components, charts, editor extensions explains 3.4x size increase. | ai | |
| source-diff | obfuscated-file:dist/chunks/VcAiAgentPanel.vue_vue_type_style_index_0_lang-D0kWIlz3.js | AI (source-diff): Standard Vite/Vue build output with long single-line bundles; sample shows readable ES module code, not obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump (v1→v2) with significant new features accounts for 593 new files. | ai | |
| phantom-deps | phantom-dep:@unovis/vue | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@fontsource/lato | AI (phantom-deps): Font asset dependency; stable pattern for this framework. | ai | |
| phantom-deps | phantom-dep:@microsoft/signalr | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@vee-validate/i18n | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@vee-validate/rules | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@fontsource/plus-jakarta-sans | AI (phantom-deps): Font asset dependency; stable pattern for this framework. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-placeholder | AI (phantom-deps): Tiptap extension re-exported by framework; stable pattern. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table-header | AI (phantom-deps): Tiptap extension re-exported by framework; stable pattern. | ai | |
| phantom-deps | phantom-dep:iso-639-1 | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@unovis/ts | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:sortablejs | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:web-vitals | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table-row | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-underline | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table-cell | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-font-size | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/pm | AI (phantom-deps): Framework package; tiptap deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:whatwg-fetch | AI (phantom-deps): Polyfill declared for consumers; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:truncate-html | AI (phantom-deps): Utility dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@headlessui/vue | AI (phantom-deps): UI dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:lucide-vue-next | AI (phantom-deps): Icon dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:tiptap-markdown | AI (phantom-deps): Tiptap extension declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/dom | AI (phantom-deps): UI utility declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/vue | AI (phantom-deps): UI utility declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:vue3-touch-events | AI (phantom-deps): Touch events dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extensions | AI (phantom-deps): Tiptap extensions declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vueuse/components | AI (phantom-deps): VueUse dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/starter-kit | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vueuse/integrations | AI (phantom-deps): VueUse dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-link | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-image | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): Bundled framework; deps referenced in config/build files, not direct imports. | ai | |
| phantom-deps | phantom-dep:@vueuse/core | AI (phantom-deps): Bundled framework; dep referenced in config files. | ai | |
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): Bundled framework; dep referenced in config files. | ai | |
| phantom-deps | phantom-dep:dompurify | AI (phantom-deps): Bundled framework; dep used via config, not direct import. | ai | |
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): Known implicit polyfill dep; not directly imported in source. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 2.0.6 | 52 / 24 | |
| 2.0.5 | 52 / 24 | |
| 2.0.4 | 52 / 24 | |
| 2.0.3 | 52 / 24 | |
| 2.0.2 | 52 / 24 | |
| 2.0.1 | 52 / 24 | |
| 2.0.0 | 52 / 24 | |
| 1.2.0 | 46 / 20 |
v2.0.6
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (andrew.kubyshkin) than the most recent previously approved version (virto) on 2026-05-25, but andrew.kubyshkin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.0.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (andrew.kubyshkin) than the most recent previously approved version (virto) on 2026-05-25, but andrew.kubyshkin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.0.4
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.