@vitessce/all
This package exports a `<Vitessce/>` component with all available plugins and file types registered.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/ReactNeuroglancer-R9DY-SSe.js | AI (source-diff): ReactNeuroglancer bundle for neuroglancer visualization; network/dynamic code is inherent to the neuroglancer library. | ai | |
| source-diff | obfuscated-file:dist/higlass-BsC0wgvT.js | AI (source-diff): Standard Vite bundle output for HiGlass; long lines are minified but readable JS, not malicious obfuscation. | ai | |
| source-diff | net-exec-file:dist/higlass-BsC0wgvT.js | AI (source-diff): Network calls and dynamic code in HiGlass bundle are part of the visualization library's normal operation. | ai | |
| source-diff | obfuscated-file:dist/index-DpX5nUsD.js | AI (source-diff): Standard Vite bundle; readable Three.js/WebGL visualization code. | ai | |
| source-diff | obfuscated-file:dist/index-DyvHlPKD.js | AI (source-diff): Main Vite bundle for vitessce; long import lines are minified but clearly legitimate vitessce API exports. | ai | |
| source-diff | net-exec-file:dist/index-DyvHlPKD.js | AI (source-diff): Network/dynamic code in main bundle is expected for a data visualization library fetching remote datasets. | ai | |
| source-diff | obfuscated-file:dist/lerc-BKoJuTs1.js | AI (source-diff): LERC decoder (Esri Apache-licensed) bundled as expected; long lines are minified codec code. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): @vitessce/all is a well-known bioinformatics visualization package; Levenshtein match to 'ajv' is a false positive. | ai | |
| phantom-deps | phantom-dep:@vitessce/error | AI (phantom-deps): Monorepo aggregator re-exports sibling packages; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vitessce/styles | AI (phantom-deps): Monorepo aggregator re-exports sibling packages; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vitessce/abstract | AI (phantom-deps): Monorepo aggregator re-exports sibling packages; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vitessce/spatial-three | AI (phantom-deps): Monorepo aggregator re-exports sibling packages; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vitessce/spatial-accelerated | AI (phantom-deps): Monorepo aggregator re-exports sibling packages; phantom-dep false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Aggregator/umbrella package in a monorepo; minimal README and no keywords are expected for internal sub-packages. | ai |
v3.9.9
8 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.