@vitessce/neuroglancer
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@janelia-flyem/neuroglancer | AI (phantom-deps): Declared dep used indirectly via config/workspace, not malicious. | ai | |
| source-diff | obfuscated-file:dist/index-CsYnzxxk.js | AI (source-diff): Vite bundle output (React/vitessce imports), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-CsYnzxxk.js | AI (source-diff): Bundled build artifact; no concrete malicious network/exec behavior found. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-D-McqGds.js | AI (source-diff): Bundled core-js/react polyfill code, not a dropper. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-BXuticss.js | AI (source-diff): Bundled polyfill/build code, no malicious behavior evidenced. | ai | |
| source-diff | net-exec-file:dist/index-DBo2EG-R.js | AI (source-diff): Bundle contains normal fetch/network code for a data viewer, not a loader. | ai | |
| source-diff | obfuscated-file:dist/index-DBo2EG-R.js | AI (source-diff): Bundled/minified Vite build output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-BCg93QGV.js | AI (source-diff): Same bundling artifact pattern, core-js polyfill code, no real network+eval malware behavior. | ai | |
| source-diff | net-exec-file:dist/index-Wdrc02VW.js | AI (source-diff): False positive on bundled polyfill/require-shim patterns in large build output. | ai | |
| source-diff | obfuscated-file:dist/index-Wdrc02VW.js | AI (source-diff): Bundled Vite output with long minified lines, not obfuscation; legitimate library code visible. | ai | |
| source-diff | obfuscated-file:dist/index-D29kYClC.js | AI (source-diff): Minified Vite bundle output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-iER_A9Wd.js | AI (source-diff): Bundled legacy polyfill/shim code (core-js style), not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/index-D29kYClC.js | AI (source-diff): Bundled React/neuroglancer UI code, no malicious network+exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/index-DvhFVdN_.js | AI (source-diff): Vite/rollup bundle output, not true obfuscation; matches package's build pipeline. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-BSLfuCt9.js | AI (source-diff): Bundled polyfills/UI code, no fetched/executed malicious payload found. | ai | |
| source-diff | net-exec-file:dist/index-DvhFVdN_.js | AI (source-diff): Bundled polyfills/UI code, no fetched/executed malicious payload found. | ai | |
| source-diff | net-exec-file:dist/index-07bc99d8.js | AI (source-diff): Bundled vendored libs; no concrete malicious network+exec behavior found. | ai | |
| source-diff | net-exec-file:dist/index-59b96224.js | AI (source-diff): Bundled vendored libs; no concrete malicious network+exec behavior found. | ai | |
| source-diff | obfuscated-file:dist/index-07bc99d8.js | AI (source-diff): Bundled Vite/Rollup output (React/core-js), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-c64b6b8f.js | AI (source-diff): Bundled vite/rollup output, not a dropper; no exfil target in code. | ai | |
| source-diff | obfuscated-file:dist/index-c64b6b8f.js | AI (source-diff): Long lines are minified bundle output (react-jsx-runtime etc), not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-33c0a163.js | AI (source-diff): Bundled vite/rollup output, not a dropper; no exfil target in code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Internal @vitessce/styles monorepo package, routine dep restructuring. | ai | |
| source-diff | obfuscated-file:dist/index-DmHg0YSX.js | AI (source-diff): Rollup web-worker base64 loader pattern, standard bundler output not obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-DVtsoLdc.js | AI (source-diff): Bundled chunk importing shared polyfills/worker code; no hostile network/exec behavior found. | ai | |
| source-diff | net-exec-file:dist/index-C_tRTP7C.js | AI (source-diff): Network calls and dynamic code are part of the Neuroglancer viewer bundle; no malicious payload in sample. | ai | |
| source-diff | obfuscated-file:dist/index-C_tRTP7C.js | AI (source-diff): Minified Vite bundle output; readable React/vitessce code visible in sample. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-CNZmy8oz.js | AI (source-diff): Standard CJS-compat shim pattern in Vite bundle for Neuroglancer; no dropper indicators in sample. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-DXStdU0p.js | AI (source-diff): Standard bundled React+neuroglancer component; Function('return this') is a commonjs polyfill pattern, not malware. | ai | |
| source-diff | obfuscated-file:dist/index-O9LG3z3b.js | AI (source-diff): Minified Vite bundle output; readable imports confirm no obfuscation. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:dist/index-O9LG3z3b.js | AI (source-diff): Network calls and dynamic code are part of the neuroglancer visualization library; no dropper behavior evident. | ai | |
| source-diff | obfuscated-file:dist/index-DsWF_aiv.js | AI (source-diff): Vite-bundled output for neuroglancer React wrapper; long lines are minified bundle, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-DsWF_aiv.js | AI (source-diff): Network calls and dynamic code are expected in a 3D neuroglancer visualization bundle; no malicious pattern. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-Yc6wLA5U.js | AI (source-diff): Same rationale — standard bundled neuroglancer React component; Function('return this') is a common CJS polyfill pattern. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-CexklRkL.js | AI (source-diff): Same rationale: Vite bundle of Neuroglancer viewer; Function('return this') is a standard CJS polyfill pattern. | ai | |
| source-diff | obfuscated-file:dist/index-CuSU8uy8.js | AI (source-diff): Vite-bundled output for a React visualization library; long lines are minified bundle, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-CuSU8uy8.js | AI (source-diff): Network calls and dynamic code in bundled React/Neuroglancer library are expected; no dropper pattern. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-C3H4HHzG.js | AI (source-diff): Same bundle context; Function('return this') is a standard CJS polyfill pattern, not malicious code execution. | ai | |
| source-diff | net-exec-file:dist/index-DK1BA3pP.js | AI (source-diff): Network calls and dynamic code are part of the Neuroglancer visualization library's normal operation, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/index-DK1BA3pP.js | AI (source-diff): Vite-bundled output with long lines; code is readable React/Neuroglancer library, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/index-Bjp1TxpY.js | AI (source-diff): Vite-bundled output; long lines are minified JS, not obfuscated malware. Stable pattern for this package. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-B3fUzgXA.js | AI (source-diff): Same pattern: bundled neuroglancer React wrapper with polyfills; not malicious. | ai | |
| source-diff | net-exec-file:dist/index-Bjp1TxpY.js | AI (source-diff): Network calls and dynamic code (Function('return this')) are standard polyfill patterns in bundled visualization library, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/index-BDIjPdOJ.js | AI (source-diff): Network calls and dynamic code in a visualization library bundle are expected; no malicious patterns in sample. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-BNZT4_8O.js | AI (source-diff): Neuroglancer React wrapper bundle; dynamic patterns are standard polyfill/module loading, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/index-BDIjPdOJ.js | AI (source-diff): Minified Vite bundle output; sample shows standard React/vitessce imports, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/index-BNWANKfn.js | AI (source-diff): Network calls and dynamic code (Function('return this')) are standard polyfill patterns in bundled neuroglancer code, not malware. | ai | |
| source-diff | obfuscated-file:dist/index-BNWANKfn.js | AI (source-diff): Vite-bundled output; long lines are minified JS, not obfuscation. Stable pattern for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher with SLSA attestation is a legitimate supply chain improvement, not a compromise. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-CfXWCAza.js | AI (source-diff): Same bundled neuroglancer pattern; Function('return this') is a global polyfill, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/index-BEPd2Tds.js | AI (source-diff): Standard vite-bundled output for a React visualization library; not obfuscated, just minified. | ai | |
| source-diff | net-exec-file:dist/ReactNeuroglancer-pv4bM8Yp.js | AI (source-diff): ReactNeuroglancer bundle; Function('return this') is a standard CJS polyfill pattern, not a dropper. | ai | |
| source-diff | net-exec-file:dist/index-BEPd2Tds.js | AI (source-diff): Network calls and dynamic code are expected in a neuroglancer/React bundle; no malicious patterns in sample. | ai | |
| dependencies | unvetted-dep:@janelia-flyem/react-neuroglancer | AI (dependencies): Janelia FlyEM react-neuroglancer is the expected upstream dependency for this neuroglancer wrapper package; stable across versions. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common; publisher track record and repo URL are consistent across 54 versions. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established scoped package in active ecosystem; missing description is metadata-only. | ai | |
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): Monorepo package; lodash-es may be used indirectly via build config or re-exports. | ai | |
| phantom-deps | phantom-dep:@vitessce/utils | AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic unreliable across monorepo boundaries. | ai | |
| dependencies | unvetted-dep:@janelia-flyem/neuroglancer | AI (dependencies): Known Janelia Research Campus neuroglancer fork; expected dependency for this neuroglancer wrapper package. | ai | |
| phantom-deps | phantom-dep:@vitessce/tooltip | AI (phantom-deps): Declared as a runtime dependency in package.json; same-org sibling package, stable false positive. | ai |
Versions (showing 51 of 51)
| Version | Deps | Published |
|---|---|---|
| 4.0.0 | 11 / 5 | |
| 3.9.11 | 12 / 5 | |
| 3.9.10 | 12 / 5 | |
| 3.9.9 | 12 / 5 | |
| 3.9.8 | 12 / 5 | |
| 3.9.7 | 12 / 5 | |
| 3.9.6 | 12 / 5 | |
| 3.9.5 | 11 / 5 | |
| 3.9.4 | 11 / 5 | |
| 3.9.3 | 11 / 5 | |
| 3.9.2 | 11 / 5 | |
| 3.9.1 | 11 / 5 | |
| 3.9.0 | 11 / 5 | |
| 3.8.13 | 11 / 5 | |
| 3.8.10 | 11 / 5 | |
| 3.8.9 | 11 / 5 | |
| 3.8.8 | 11 / 5 | |
| 3.8.7 | 11 / 5 | |
| 3.8.6 | 11 / 5 | |
| 3.8.5 | 11 / 5 | |
| 3.8.4 | 11 / 5 | |
| 3.8.3 | 11 / 5 | |
| 3.8.2 | 11 / 5 | |
| 3.8.1 | 11 / 5 | |
| 3.8.0 | 11 / 5 | |
| 3.7.1 | 11 / 5 | |
| 3.7.0 | 10 / 6 | |
| 3.6.18 | 10 / 6 | |
| 3.6.17 | 10 / 6 | |
| 3.6.16 | 10 / 6 | |
| 3.6.15 | 10 / 6 | |
| 3.6.14 | 10 / 6 | |
| 3.6.13 | 10 / 6 | |
| 3.6.12 | 10 / 6 | |
| 3.6.11 | 10 / 6 | |
| 3.6.10 | 10 / 6 | |
| 3.6.9 | 10 / 6 | |
| 3.6.8 | 10 / 6 | |
| 3.6.7 | 10 / 6 | |
| 3.6.6 | 10 / 6 | |
| 3.6.5 | 10 / 6 | |
| 3.6.4 | 10 / 6 | |
| 3.6.3 | 10 / 6 | |
| 3.6.2 | 10 / 6 | |
| 3.6.1 | 9 / 6 | |
| 3.6.0 | 5 / 6 | |
| 3.5.12 | 5 / 5 | |
| 3.5.11 | 5 / 5 | |
| 3.5.10 | 5 / 5 | |
| 3.5.9 | 5 / 5 | |
| 3.5.8 | 5 / 5 |
v4.0.0
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.6
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.5
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.4
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.3
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.8
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.6.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.11
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.10
4 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.9
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.5.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.