@visulima/dev-toolbar
OIDC trusted publishing setup package for @visulima/dev-toolbar
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/apps/inspector/index.js | AI (source-diff): Bundled Vite/preact output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/toolbar/index.js | AI (source-diff): Bundled build output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/packem_chunks/inject-source.js | AI (source-diff): Bundled build output. | ai | |
| source-diff | obfuscated-file:dist/packem_shared/sharedToolbarStylesheet-DCndH0A0.js | AI (source-diff): Bundled CSS/JS chunk. | ai | |
| source-diff | obfuscated-file:dist/mcp/server.js | AI (source-diff): Bundled MCP server output. | ai | |
| provenance | publisher-changed | AI (provenance): CI/CD provenance improvement, not a compromise indicator. | ai | |
| phantom-deps | phantom-dep:@babel/parser | AI (phantom-deps): Framework-convention dependency. | ai | |
| phantom-deps | phantom-dep:@babel/traverse | AI (phantom-deps): Framework-convention dependency. | ai | |
| phantom-deps | phantom-dep:@floating-ui/dom | AI (phantom-deps): Referenced via config, not direct import. | ai |
v1.0.0
19 findingsThis version was published by a different npm account than previous versions on 2026-07-03. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.