@vc-shell/framework
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/framework.js | AI (source-diff): Vite/rollup bundle output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/vendor-lodash-es-BqkGj3Jl.js | AI (source-diff): lodash-es bundle; benign vendored utility code. | ai | |
| source-diff | net-exec-file:dist/vendor-core-js-DDuR6YMQ.js | AI (source-diff): core-js polyfill bundle; globalThis detection, no real network+exec malware. | ai | |
| phantom-deps | phantom-dep:js-beautify | AI (phantom-deps): Used via config/tooling, not direct import. | ai | |
| phantom-deps | phantom-dep:rrule | AI (phantom-deps): New scheduler feature dep referenced via config, not direct import. | ai | |
| source-diff | bulk-obfuscated-files:dist | AI (source-diff): Standard Vite/Rollup bundled chunks, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/chunks/VcAiAgentPanel.vue_vue_type_style_index_0_lang-CTHTF63Q.js | AI (source-diff): Standard Vite-minified Vue component chunk; readable imports and class definitions confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/chunks/VcAiAgentPanel.vue_vue_type_style_index_0_lang-D5HgEXFw.js | AI (source-diff): Standard minified Vue SFC bundle chunk; long lines are build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/chunks/VcAiAgentPanel.vue_vue_type_style_index_0_lang-D0kWIlz3.js | AI (source-diff): Standard Vite/Vue build output with long single-line bundles; sample shows readable ES module code, not obfuscation. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Major version rewrite with new UI components, charts, editor extensions explains 3.4x size increase. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major version bump (v1→v2) with significant new features accounts for 593 new files. | ai | |
| phantom-deps | phantom-dep:@fontsource/plus-jakarta-sans | AI (phantom-deps): Font asset dependency; stable pattern for this framework. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-placeholder | AI (phantom-deps): Tiptap extension re-exported by framework; stable pattern. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table-header | AI (phantom-deps): Tiptap extension re-exported by framework; stable pattern. | ai | |
| phantom-deps | phantom-dep:@unovis/ts | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:iso-639-1 | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:sortablejs | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:web-vitals | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@unovis/vue | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@fontsource/lato | AI (phantom-deps): Font asset dependency; stable pattern for this framework. | ai | |
| phantom-deps | phantom-dep:@microsoft/signalr | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@vee-validate/i18n | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@vee-validate/rules | AI (phantom-deps): UI framework re-exports; referenced in config, stable pattern. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table-cell | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/pm | AI (phantom-deps): Framework package; tiptap deps declared for consumers, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:whatwg-fetch | AI (phantom-deps): Polyfill declared for consumers; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:truncate-html | AI (phantom-deps): Utility dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@headlessui/vue | AI (phantom-deps): UI dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:lucide-vue-next | AI (phantom-deps): Icon dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:tiptap-markdown | AI (phantom-deps): Tiptap extension declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/dom | AI (phantom-deps): UI utility declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/vue | AI (phantom-deps): UI utility declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:vue3-touch-events | AI (phantom-deps): Touch events dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extensions | AI (phantom-deps): Tiptap extensions declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vueuse/components | AI (phantom-deps): VueUse dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/starter-kit | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vueuse/integrations | AI (phantom-deps): VueUse dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-link | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-image | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-font-size | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-table-row | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-underline | AI (phantom-deps): Tiptap dep declared for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): Bundled framework; deps referenced in config/build files, not direct imports. | ai | |
| phantom-deps | phantom-dep:@vueuse/core | AI (phantom-deps): Bundled framework; dep referenced in config files. | ai | |
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): Bundled framework; dep referenced in config files. | ai | |
| phantom-deps | phantom-dep:dompurify | AI (phantom-deps): Bundled framework; dep used via config, not direct import. | ai | |
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): Known implicit polyfill dep; not directly imported in source. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 2.2.0 | 52 / 25 | |
| 2.0.6 | 52 / 24 | |
| 2.0.5 | 52 / 24 | |
| 2.0.4 | 52 / 24 | |
| 2.0.3 | 52 / 24 | |
| 2.0.2 | 52 / 24 | |
| 2.0.1 | 52 / 24 | |
| 2.0.0 | 52 / 24 | |
| 1.2.3 | 46 / 20 | |
| 1.2.2 | 46 / 20 | |
| 1.2.1 | 46 / 20 | |
| 1.2.0 | 46 / 20 |
v2.2.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (andrew.kubyshkin) on 2026-07-20, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.2.3
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.2
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.2.1
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.