@visulima/boxen
12
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
prisis
Keywords
anolilabansiasciiborderboxboxenboxescliconsolegradienttermterminaltextunicodevisulima
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/index.js | AI (source-diff): Minified bundler output with Unicode-width tables, not true obfuscation; stable for this build. | ai | |
| source-diff | net-exec-file:dist/index.js | AI (source-diff): execFileSync is terminal-width detection in bundled CLI lib; no hostile destination. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 0 / 0 | |
| 2.0.10 | 0 / 0 | |
| 2.0.9 | 0 / 0 | |
| 2.0.8 | 0 / 0 | |
| 2.0.7 | 0 / 0 | |
| 2.0.6 | 0 / 0 | |
| 2.0.5 | 0 / 0 | |
| 2.0.4 | 0 / 0 | |
| 2.0.3 | 0 / 0 | |
| 2.0.2 | 0 / 0 | |
| 2.0.1 | 0 / 0 | |
| 2.0.0 | 0 / 0 |
v3.0.0
4 findings
HIGH
Publisher changed: prisis → GitHub Actions (on 2026-07-03)
provenance
This version was published by a different npm account than previous versions on 2026-07-03. This could indicate a legitimate maintainer transition or an account compromise.
HIGH
New obfuscated file: dist/index.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/index.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.