@volcengine/rtc

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (xiongxiong.001) than the most recent previously approved version (luofan.0406) on 2026-03-16, but xiongxiong.001 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2026-01-20, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-12-03, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (xiongxiong.001) than the most recent previously approved version (luofan.0406) on 2026-03-16, but xiongxiong.001 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2026-01-20, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2026-01-13, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-12-05, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-12-03, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-11-17, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-11-04, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (xiongxiong.001) than the most recent previously approved version (luofan.0406) on 2026-03-16, but xiongxiong.001 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2026-01-20, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2026-01-15, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-12-05, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-12-03, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-11-17, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-11-04, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-12-05, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-11-25, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (vcloud_fe) than the most recent previously approved version (luofan.0406) on 2025-11-25, but vcloud_fe is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (zhengwenyue) than the most recent previously approved version (zhangzhimeng.vivi) on 2022-11-29. It has since remained available on npm for 1332 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: luofan.0406.

This version was published by a different npm account than previous versions on 2025-04-25. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (zhengwenyue) than the most recent previously approved version (zhangzhimeng.vivi) on 2022-11-29. It has since remained available on npm for 1331 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (zhangzhimeng.vivi) than the most recent previously approved version (changzhn) on 2022-09-21, but zhangzhimeng.vivi is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

This version was published by a different npm account than previous versions on 2025-04-25. This could indicate a legitimate maintainer transition or an account compromise.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (zhangzhimeng.vivi) than the most recent previously approved version (changzhn) on 2022-09-26, but zhangzhimeng.vivi is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (zhangzhimeng.vivi) than the most recent previously approved version (changzhn) on 2022-08-31, but zhangzhimeng.vivi is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (shushushu) than the most recent previously approved version (zhengwenyue) on 2023-04-10, but shushushu is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: changzhn.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (changzhn) than the most recent previously approved version (leonardo-fu) on 2022-05-18, but changzhn is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.