@volcengine/vephone
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/index.umd.min.js | AI (source-diff): Minified bundle artifact unchanged from prior approved version, not new obfuscation. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable metadata gap across this publisher's packages, not a risk indicator. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Long-tenured trusted publisher account; no other malicious signal to corroborate compromise. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Volcengine SDK with 30 versions; missing metadata is a consistent pattern for this package, not a spam indicator. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 1.68.0 | 0 / 0 | |
| 1.66.0 | 0 / 0 | |
| 1.65.0 | 0 / 0 | |
| 1.60.0 | 0 / 0 | |
| 1.59.2 | 0 / 0 | |
| 1.59.1 | 0 / 0 | |
| 1.59.0 | 0 / 0 | |
| 1.54.1 | 0 / 0 | |
| 1.49.0 | 0 / 0 | |
| 1.45.0 | 0 / 0 | |
| 1.44.0 | 0 / 0 | |
| 1.43.0 | 0 / 0 |
v1.54.1
2 findings[Reject — re-review on republish] (prior reject: AI (source-diff): 15 long encoded strings in a newly modified 2.1MB bundle with no source; high-risk obfuscation pattern.) Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.49.0
2 findings[Reject — re-review on republish] (prior reject: AI (source-diff): 15 long encoded strings in a newly modified 2.1MB bundle with no source; high-risk obfuscation pattern.) Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.45.0
2 findings[Reject — re-review on republish] (prior reject: AI (source-diff): 15 long encoded strings in a newly modified 2.1MB bundle with no source; high-risk obfuscation pattern.) Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.44.0
2 findings[Reject — re-review on republish] (prior reject: AI (source-diff): 15 long encoded strings in a newly modified 2.1MB bundle with no source; high-risk obfuscation pattern.) Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.43.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.