@webitel/ui-sdk
Main lib
100
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
dlohvinovnavrotskyjbiedulina_valeriia
Keywords
webitelui-sdk
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:clipboard-copy | AI (phantom-deps): Config-referenced utility; stable phantom-dep for this package. | ai | |
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): Utility library; phantom-dep pattern stable for this package. | ai | |
| source-diff | obfuscated-file:dist/components-B15PvOcM.js | AI (source-diff): Bundled rolldown/vite output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-DGWoMhRa.js | AI (source-diff): Bundled build output including vendored emoji-picker-element, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-C6on11Sy.js | AI (source-diff): Bundled Vue component chunk with inline SVG data URIs. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CTPVly8F.js | AI (source-diff): Bundled Vue component chunk with inline SVG data URIs. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BnvbAcO2.js | AI (source-diff): Bundled emoji-picker chunk, minified build output. | ai | |
| source-diff | net-exec-file:dist/install-DMJcykml.js | AI (source-diff): Bundled vue/runtime chunk; setTimeout polyfill misflagged as net-exec. | ai | |
| source-diff | obfuscated-file:dist/install-DMJcykml.js | AI (source-diff): Vite-bundled vue chunk, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/install-Dy8FCdqU.js | AI (source-diff): Vite bundle chunk with long minified lines, not true obfuscation; contains normal Vue vendor code. | ai | |
| source-diff | net-exec-file:dist/install-Dy8FCdqU.js | AI (source-diff): Bundled vendor code (setTimeout polyfill etc.), no fetched-binary or credential exfil behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-T8LDtZS-.js | AI (source-diff): Bundled emoji-picker-element dependency code, standard minified build output. | ai | |
| source-diff | obfuscated-file:dist/components-DaDed2hn.js | AI (source-diff): Rolldown/Vite bundled output, not true obfuscation; no malicious behavior in sample. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CRLQgNyV.js | AI (source-diff): Bundled Vite component chunk, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-B70MyRhI.js | AI (source-diff): Bundled Vite component chunk, not obfuscated. | ai | |
| source-diff | net-exec-file:dist/install-qEvz8pVq.js | AI (source-diff): Bundled polyfill/setTimeout code misidentified as net+exec dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/install-qEvz8pVq.js | AI (source-diff): Bundled Vite output with long minified lines, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DsRV4jMt.js | AI (source-diff): Bundled Vite component chunk with embedded SVG data URIs, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/install-DawOaJvS.js | AI (source-diff): Vite-bundled Vue chunk with visible imports; long lines are minification, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-BxEArso4.js | AI (source-diff): Bundled Vue component chunk, not obfuscated. | ai | |
| source-diff | net-exec-file:dist/install-DawOaJvS.js | AI (source-diff): setTimeout/network polyfill shims in bundled runtime, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-0UBEtnmy.js | AI (source-diff): Same Vite bundling pattern as other dist chunks. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-rcqO8ZX0.js | AI (source-diff): Bundled Vue component chunk, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-BZH5aqRk.js | AI (source-diff): Bundled Vue component chunk, not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/install-Cu0d6sby.js | AI (source-diff): Vite/rollup bundled chunk, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CGS_HHH7.js | AI (source-diff): Bundled component chunk, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CnH3EakG.js | AI (source-diff): Bundled component chunk, minified not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CTDXxrpz.js | AI (source-diff): Bundled component chunk, minified not obfuscated. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Expected from Vite chunk re-hashing on build, not injected code. | ai | |
| source-diff | net-exec-file:dist/install-Cu0d6sby.js | AI (source-diff): Bundled polyfill code (setTimeout shim), no real network+exec malware pattern. | ai | |
| source-diff | obfuscated-file:dist/components-rPVG1iQS.js | AI (source-diff): Bundled/minified vite output, not true obfuscation; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-DnG7Ikl3.js | AI (source-diff): Bundled/minified vite output, not true obfuscation; standard build artifact. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): CI/CD-driven monorepo releases publish in quick succession normally. | ai | |
| source-diff | obfuscated-file:dist/components-reoSYpZx.js | AI (source-diff): Minified Vue/rolldown bundle output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components-CCbLe_rX.js | AI (source-diff): Bundled Vite/Rollup output, not obfuscation; standard chunked imports visible in sample. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-C5bcHSS2.js | AI (source-diff): Bundled chunk containing SVG data URIs, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DiACrMLr.js | AI (source-diff): Bundled chunk containing SVG data URIs, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/install-CHotEUqR.js | AI (source-diff): Vite/Rollup bundle chunk, not true obfuscation; no malicious payload. | ai | |
| source-diff | net-exec-file:dist/install-CHotEUqR.js | AI (source-diff): Bundled Vue/vendor code with standard timers/network shims, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BnIHndFW.js | AI (source-diff): Bundled chunk (emoji picker vendor code), not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components-B78RTsRa.js | AI (source-diff): Minified rolldown/vite bundle output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-icon-y89gRcOs.js | AI (source-diff): Minified bundle including dompurify, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CgEh5BAF.js | AI (source-diff): Minified vite bundle with inlined SVG assets, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-D3pE1OO5.js | AI (source-diff): Minified bundle of emoji-picker-element, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components-B22ObVX2.js | AI (source-diff): Bundled Vite/Rollup output, not obfuscation; readable imports and component code. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-C1Ps8-7X.js | AI (source-diff): Bundled vendor code (emoji-picker-element), not true obfuscation. | ai | |
| phantom-deps | phantom-dep:vue-observe-visibility | AI (phantom-deps): Used via config/plugin wiring, common false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/components-rjTUkhKS.js | AI (source-diff): Bundled vite/rolldown output, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components-C0M-1soD.js | AI (source-diff): Vite/Rollup bundled chunk output, not obfuscation; expected for this UI library's build. | ai | |
| source-diff | obfuscated-file:dist/components-XaNw-CXF.js | AI (source-diff): Vite-bundled ESM output with readable imports and Vue component code; minification is expected for this UI SDK's dist artifacts. | ai | |
| npm-metadata | url-dep:xlsx | AI (npm-metadata): SheetJS CDN URL is the documented distribution method for xlsx commercial builds; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-C1zN_XxY.js | AI (source-diff): Minified emoji-picker component bundle; expected Vite output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CfPgkG4K.js | AI (source-diff): Minified Vue error-page component with URL-encoded SVG; expected Vite output. | ai | |
| source-diff | obfuscated-file:dist/install-BvApURVu.js | AI (source-diff): Standard Vite bundle output for a Vue UI SDK; minified lines are expected build artifacts. | ai | |
| source-diff | net-exec-file:dist/install-BvApURVu.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle reflect normal Vue/browser APIs, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CIG33Bvh.js | AI (source-diff): Minified Vue component with URL-encoded SVG; expected Vite output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-9s17uhsm.js | AI (source-diff): Minified emoji-picker component bundle; long lines are URL-encoded SVG and emoji data. | ai | |
| source-diff | net-exec-file:dist/install-DKioXUP5.js | AI (source-diff): Network calls are emoji CDN fetches; dynamic code execution is Vue's runtime rendering — no dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/install-DKioXUP5.js | AI (source-diff): Standard Vite-minified bundle for a Vue UI SDK; long lines are minified JS, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-Bzr1kFF0.js | AI (source-diff): Long line is a URL-encoded inline SVG asset, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-D16zYZHs.js | AI (source-diff): Long line is a URL-encoded inline SVG asset, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DaEhkaf3.js | AI (source-diff): Long line is a URL-encoded inline SVG asset, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BnUOeO8-.js | AI (source-diff): Minified Vue error page component with inline SVG; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DIgZ8bQn.js | AI (source-diff): Minified Vue table component with inline SVG data URI; normal build artifact. | ai | |
| source-diff | net-exec-file:dist/install-Cw70YuWu.js | AI (source-diff): Network calls are emoji CDN fetches from emoji-picker-element; dynamic code execution is Vue's runtime renderer, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/install-Cw70YuWu.js | AI (source-diff): Standard Vite-minified bundle; long lines are normal minified Vue component output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-D3KxOkZg.js | AI (source-diff): Minified Vue component with inline SVG data URI; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-DLUjfqtV.js | AI (source-diff): Minified emoji-picker-element component bundle; long lines are normal minified output. | ai | |
| source-diff | obfuscated-file:dist/install-QMIeJaQP.js | AI (source-diff): Standard Vite bundle output with readable Vue imports; hashed filename is normal for this SDK's build pipeline. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-D_WumGk-.js | AI (source-diff): Vite bundle with URL-encoded SVG paths causing long lines; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-9zwFlOGt.js | AI (source-diff): Vite bundle with SVG data URI and Vue imports; long lines from URL-encoded SVG, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-B3x1ns7c.js | AI (source-diff): Vite-bundled emoji-picker component; readable IndexedDB/emoji logic, not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/install-QMIeJaQP.js | AI (source-diff): Network calls are emoji CDN fetches (jsdelivr); dynamic execution is Vue's runtime rendering — no dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-wQl12mpX.js | AI (source-diff): Minified Vite chunk for emoji-picker-element integration; sample shows legitimate IndexedDB/emoji logic. | ai | |
| source-diff | net-exec-file:dist/install-BP0xjIqw.js | AI (source-diff): Network calls and dynamic code in a Vue UI SDK bundle are expected (fetch for emoji data, dynamic component resolution). | ai | |
| source-diff | obfuscated-file:dist/install-BP0xjIqw.js | AI (source-diff): Standard Vite minified bundle output; Vue component code visible in sample, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BsQWdBV3.js | AI (source-diff): Minified Vite chunk with inline SVG data URI for error page component; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CQb-PC3M.js | AI (source-diff): Minified Vite chunk with inline SVG data URI; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-G7W4o8aF.js | AI (source-diff): Minified emoji-picker-element chunk; legitimate UI component bundle. | ai | |
| source-diff | net-exec-file:dist/install-Cbk4uI4d.js | AI (source-diff): Network call is emoji CDN fetch (jsdelivr); dynamic code execution is Vue's runtime component resolution, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/install-Cbk4uI4d.js | AI (source-diff): Standard Vite-minified bundle; Vue imports and component patterns confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-ClQKPnOX.js | AI (source-diff): Minified Vue component chunk with inline SVG data URIs; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CP3Eb2Ze.js | AI (source-diff): Minified Vue component with inline SVG; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CrNmO1uD.js | AI (source-diff): Minified Vue component chunk; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-P4gAwDj2.js | AI (source-diff): Minified Vue error-page component with inline SVG; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-07cnh7OP.js | AI (source-diff): Minified Vue component with URL-encoded SVG inline data; no malicious pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-Cl3YsoL-.js | AI (source-diff): Minified emoji-picker-element bundle; CDN URL is the documented jsdelivr endpoint. | ai | |
| source-diff | net-exec-file:dist/install-BLruag0s.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are normal (CDN emoji data, Vue async components); no dropper pattern visible. | ai | |
| source-diff | obfuscated-file:dist/install-BLruag0s.js | AI (source-diff): Standard Vite bundle output for a Vue UI SDK; minified but not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-C6ouRDpj.js | AI (source-diff): Minified Vite chunk for emoji picker; CDN URL is emoji-picker-element-data, expected. | ai | |
| source-diff | net-exec-file:dist/install-BjrTYVuH.js | AI (source-diff): Network refs are emoji CDN URLs; dynamic code execution is Vue's runtime rendering — normal for bundled UI SDK. | ai | |
| source-diff | obfuscated-file:dist/install-BjrTYVuH.js | AI (source-diff): Standard Vite-minified bundle; imports from vue, no malicious patterns in samples. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DUjDNDdD.js | AI (source-diff): Minified Vite chunk with SVG data URI; standard UI component bundle. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CZ21yq7F.js | AI (source-diff): Minified Vite chunk with SVG path data; no suspicious network or exec patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DvlpQwdd.js | AI (source-diff): Minified Vite chunk containing only SVG data URIs and Vue component code. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-kUghLeQf.js | AI (source-diff): Minified Vue component with URL-encoded SVG assets; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DFGN6FD3.js | AI (source-diff): Minified error page component with URL-encoded SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CwaITVmJ.js | AI (source-diff): Minified Vue table component; standard Vite bundle output. | ai | |
| source-diff | obfuscated-file:dist/install-BZ4Ll9xZ.js | AI (source-diff): Standard Vite bundle output for a Vue UI SDK; minified but not malicious. | ai | |
| source-diff | net-exec-file:dist/install-BZ4Ll9xZ.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are normal Vue/browser patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-C3LwXeuf.js | AI (source-diff): Minified emoji-picker component bundle; sample shows legitimate IndexedDB/emoji logic. | ai | |
| source-diff | net-exec-file:dist/install-B9mEbC1e.js | AI (source-diff): Network call is emoji-picker CDN fetch; dynamic code is standard Vue reactivity — no dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-bKAQJCzB.js | AI (source-diff): URL-encoded SVG inline data triggers long-line heuristic; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BuqKztx9.js | AI (source-diff): URL-encoded SVG inline data triggers long-line heuristic; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-BDal03X2.js | AI (source-diff): URL-encoded SVG inline data triggers long-line heuristic; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-Butxeu9m.js | AI (source-diff): Vite-bundled emoji-picker component; minified but readable Vue/IndexedDB code. | ai | |
| source-diff | obfuscated-file:dist/install-B9mEbC1e.js | AI (source-diff): Standard Vite build output; minified Vue component bundle, not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/install-BXREehT0.js | AI (source-diff): Network calls and dynamic imports are expected in a Vue UI SDK bundle; no dropper pattern present. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CQtHxPpC.js | AI (source-diff): URL-encoded SVG data URI causes long lines; standard Vite build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-2dRldTsx.js | AI (source-diff): URL-encoded SVG data URI in minified bundle; standard Vite build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DhEfFC-r.js | AI (source-diff): URL-encoded SVG data URI causes long lines; standard Vite build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CBuFqp8y.js | AI (source-diff): Minified emoji-picker-element bundle chunk; URL-encoded SVG and long lines are normal. | ai | |
| source-diff | obfuscated-file:dist/install-BXREehT0.js | AI (source-diff): Standard Vite minified bundle; long lines are normal for bundled Vue component output. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-C9UkoHgS.js | AI (source-diff): Minified Vue table component; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BaAY3DEc.js | AI (source-diff): Minified Vue error-page component with inline SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-jL-TifzB.js | AI (source-diff): Minified Vue component with inline SVG data URI; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BVVHukIE.js | AI (source-diff): Minified emoji-picker-element bundle; CDN URL is public emoji data, not malicious. | ai | |
| source-diff | net-exec-file:dist/install-DG3Vb8gz.js | AI (source-diff): Network call is emoji CDN fetch; no dynamic code execution beyond normal Vue runtime patterns. | ai | |
| source-diff | obfuscated-file:dist/install-DG3Vb8gz.js | AI (source-diff): Standard Vite-minified bundle; readable Vue imports confirm legitimate build output. | ai | |
| source-diff | obfuscated-file:dist/install-DRmtBDPZ.js | AI (source-diff): Standard Vite minified bundle for a Vue UI SDK; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-Bx6xnTPb.js | AI (source-diff): Minified Vite chunk; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-Cen2rI3S.js | AI (source-diff): Minified Vite chunk with URL-encoded SVG error page; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-f6SNJubN.js | AI (source-diff): Minified Vite chunk with URL-encoded SVG; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-T-xI5PI0.js | AI (source-diff): Minified Vite chunk for emoji picker component; not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/install-DRmtBDPZ.js | AI (source-diff): Network call is emoji-picker CDN fetch; dynamic execution is normal Vue/JS runtime patterns in a minified bundle. | ai | |
| source-diff | obfuscated-file:dist/install-Oyx1yl4G.js | AI (source-diff): Standard Vite build output; minified Vue component bundle, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-BtQx95nL.js | AI (source-diff): Minified Vue table component chunk; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DdIOPYaK.js | AI (source-diff): Minified Vue error page component with inline SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CSSdXJ4_.js | AI (source-diff): Minified Vue component with inline SVG data URIs; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-Bk7whTQ1.js | AI (source-diff): Vite-minified emoji picker component chunk; sample shows legitimate IndexedDB/emoji logic. | ai | |
| source-diff | net-exec-file:dist/install-Oyx1yl4G.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are expected (fetch for emoji data, dynamic component loading). | ai | |
| source-diff | obfuscated-file:dist/install-C5xKFRc9.js | AI (source-diff): Standard Vite-minified bundle; Vue imports and normal JS patterns visible in sample. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DOiMYkBj.js | AI (source-diff): Minified Vite output; standard Vue component with URL-encoded SVG. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-C1EXQCuO.js | AI (source-diff): Minified Vite output; URL-encoded SVG paths for error page illustration. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CSy2l8r-.js | AI (source-diff): Minified Vite output; contains only URL-encoded SVG and Vue component code. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-B_m4NMsW.js | AI (source-diff): Minified Vite output for emoji picker component; normal Vue/IndexedDB patterns. | ai | |
| source-diff | net-exec-file:dist/install-C5xKFRc9.js | AI (source-diff): Network call is emoji-picker-element CDN data fetch; no dropper/loader pattern present. | ai | |
| source-diff | net-exec-file:dist/install-D_goYtnz.js | AI (source-diff): Network call is emoji-picker-element CDN data fetch; dynamic code execution is normal Vue runtime behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DdMotrHk.js | AI (source-diff): Vite-bundled error page component with URL-encoded SVG; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DztLsixT.js | AI (source-diff): Vite-bundled Vue component with URL-encoded SVG inline data; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CI3V_BeW.js | AI (source-diff): Vite-bundled emoji picker component; minified output from emoji-picker-element dependency. | ai | |
| source-diff | obfuscated-file:dist/install-D_goYtnz.js | AI (source-diff): Standard Vite-bundled Vue SDK chunk; minified but not obfuscated, no malicious patterns. | ai | |
| source-diff | net-exec-file:dist/install-DUod_8Ku.js | AI (source-diff): Network call is emoji CDN fetch; dynamic exec is Vue runtime rendering — both expected for this UI library. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BhgTuky5.js | AI (source-diff): Minified Vue error-page component with inline SVG; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-4X6y_x3K.js | AI (source-diff): Minified Vue component bundle with inline SVG data URI; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BXPjqZI0.js | AI (source-diff): Minified emoji-picker component bundle; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/install-DUod_8Ku.js | AI (source-diff): Standard Vite/rollup minified bundle output for a Vue UI SDK; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/install-D-9lCFRH.js | AI (source-diff): Standard Vite-minified bundle of Vue UI components; consistent with package's build pattern. | ai | |
| source-diff | net-exec-file:dist/install-D-9lCFRH.js | AI (source-diff): Network call is emoji-picker CDN fetch (jsdelivr); no dynamic code execution beyond normal Vue runtime. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CZqq7ahF.js | AI (source-diff): Minified Vue table component; benign build artifact consistent with package pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CBhqtPBV.js | AI (source-diff): Minified Vue error-page component with inline SVG; benign build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DpBCEOgb.js | AI (source-diff): Minified Vue component with URL-encoded SVG; benign build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-D7JnDZ0s.js | AI (source-diff): Minified emoji-picker-element bundle; expected output for declared emoji-picker-element dependency. | ai | |
| source-diff | obfuscated-file:dist/install-DONrHk5A.js | AI (source-diff): Standard Vite bundle output for a Vue component library; long lines are minified but not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-C_UemiSa.js | AI (source-diff): Minified Vite chunk; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-C_K_Wl-Q.js | AI (source-diff): Minified Vite chunk with URL-encoded SVG; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-BsFcQNhv.js | AI (source-diff): Minified Vite chunk with URL-encoded SVG data; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CNC9MRVw.js | AI (source-diff): Minified Vite chunk for emoji picker component; not obfuscated. | ai | |
| source-diff | net-exec-file:dist/install-DONrHk5A.js | AI (source-diff): Network calls are emoji-picker CDN data fetch; dynamic code execution is normal Vue reactivity/component patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-90ODifPL.js | AI (source-diff): Minified Vite bundle with SVG data URI; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/install-B5iwjh5w.js | AI (source-diff): Standard Vite-minified Vue bundle; long lines are normal build output for this UI SDK. | ai | |
| source-diff | net-exec-file:dist/install-B5iwjh5w.js | AI (source-diff): Network call is emoji-picker CDN data fetch; no dynamic code execution beyond normal Vue runtime patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-trW77w8T.js | AI (source-diff): Minified Vite bundle for emoji picker component; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-B0LV4XZG.js | AI (source-diff): Minified Vite bundle with SVG data URI; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-BPJBffsX.js | AI (source-diff): Minified Vite bundle with SVG data URI; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/install-Cr0bk3L_.js | AI (source-diff): Standard Vite-minified bundle for a Vue UI SDK; long lines are normal bundler output, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/install-Cr0bk3L_.js | AI (source-diff): Network calls are emoji CDN fetches; dynamic code execution is Vue reactivity runtime — no dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CL-ZeHBE.js | AI (source-diff): Minified Vite bundle for emoji picker component; expected output for this package. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DRMzAM9O.js | AI (source-diff): Minified Vite bundle with URL-encoded SVG data; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-bVs4FU_6.js | AI (source-diff): Minified Vite bundle with URL-encoded SVG; normal build artifact for this UI SDK. | ai | |
| source-diff | obfuscated-file:dist/install-DJFUeaKV.js | AI (source-diff): Vite-bundled Vue component library output; long lines are minified build artifacts, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/install-DJFUeaKV.js | AI (source-diff): False positive on bundled Vue app code with standard fetch/dynamic-import patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-C4k-DhDC.js | AI (source-diff): Minified table component chunk; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DGdwU4In.js | AI (source-diff): Minified error page chunk with inline SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-sXbqwELW.js | AI (source-diff): Minified chunk with inline SVG data URIs; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BlNdCD8_.js | AI (source-diff): Minified emoji-picker chunk; standard build output. | ai | |
| source-diff | net-exec-file:dist/install-BuMO14Rb.js | AI (source-diff): Network calls and dynamic code in Vue component bundles are expected for this UI SDK. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-Dh0I10zQ.js | AI (source-diff): Long lines are URL-encoded SVG data in a standard Vite bundle. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DeqGCW4M.js | AI (source-diff): Long lines are URL-encoded SVG data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-6IZXyyQv.js | AI (source-diff): Minified Vite chunk; emoji CDN URL is from emoji-picker-element dependency, not malicious. | ai | |
| source-diff | obfuscated-file:dist/install-BuMO14Rb.js | AI (source-diff): Standard Vite minified bundle; long lines are normal for this package's dist output. | ai | |
| source-diff | obfuscated-file:dist/install-MeHxIEWi.js | AI (source-diff): Standard Vite-minified bundle for a Vue UI SDK; content shows normal Vue/ESM imports, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-fD1n6Ca8.js | AI (source-diff): Long lines are URL-encoded SVG path data for error page illustration, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-BJqC03G2.js | AI (source-diff): Long lines are URL-encoded SVG data, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-gtRYtqkJ.js | AI (source-diff): Minified emoji-picker-element bundle; content is clearly emoji picker IndexedDB logic, not malicious. | ai | |
| source-diff | net-exec-file:dist/install-MeHxIEWi.js | AI (source-diff): Network calls and dynamic code in bundled Vue UI SDK are expected (fetch for emoji data, dynamic component loading). | ai | |
| source-diff | net-exec-file:dist/install-Uz_WcuKf.js | AI (source-diff): Network call is emoji-picker CDN fetch (jsdelivr); no dynamic code execution beyond normal Vue runtime. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DYdNWZch.js | AI (source-diff): Vite bundle chunk with URL-encoded SVG path data; minified but not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-S6P5IFvl.js | AI (source-diff): Vite bundle chunk with URL-encoded SVG; minified but not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CtvAfq9L.js | AI (source-diff): Vite bundle chunk for emoji picker component; minified but not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/install-Uz_WcuKf.js | AI (source-diff): Standard Vite-bundled Vue component chunk; minification triggers rule but content is benign. | ai | |
| source-diff | net-exec-file:dist/install-MwLwnvU6.js | AI (source-diff): Network call is emoji-picker-element fetching CDN emoji data; no dynamic code execution of remote content. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-nil4zmk5.js | AI (source-diff): Minified Vite chunk with URL-encoded SVG error page graphic; normal build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CjuwwVGB.js | AI (source-diff): Minified Vite chunk containing URL-encoded SVG; normal build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-DYXEUfIV.js | AI (source-diff): Minified Vite chunk for emoji picker component; normal build output. | ai | |
| source-diff | obfuscated-file:dist/install-MwLwnvU6.js | AI (source-diff): Standard Vite minified bundle for a Vue UI SDK; long lines are normal minification output. | ai | |
| source-diff | net-exec-file:dist/install-D-fDpH8o.js | AI (source-diff): Network calls are emoji CDN data fetches; dynamic code execution is Vue's runtime rendering — no dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-C-UOZm82.js | AI (source-diff): URL-encoded SVG error page illustration in minified Vue component; normal build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CXxTx5PV.js | AI (source-diff): URL-encoded SVG assets in minified Vue component; normal build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-7BCR-KNF.js | AI (source-diff): Minified emoji-picker-element bundle; matches declared emoji-picker-element dependency. | ai | |
| source-diff | obfuscated-file:dist/install-D-fDpH8o.js | AI (source-diff): Standard Vite bundle of Vue UI components; minified lines are normal build output for this SDK. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CQ2r3NMw.js | AI (source-diff): Vite bundle with inline SVG data URI; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-B3gopWBB.js | AI (source-diff): Vite bundle with inline SVG; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DamPrF3N.js | AI (source-diff): Vite bundle with inline SVG data URI; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-DlCyrANh.js | AI (source-diff): Vite-bundled emoji picker component; minified but readable Vue/IndexedDB logic. | ai | |
| source-diff | net-exec-file:dist/install-PDJJDxnH.js | AI (source-diff): Network call is emoji CDN data fetch; no dynamic code execution beyond normal Vue rendering. | ai | |
| source-diff | obfuscated-file:dist/install-PDJJDxnH.js | AI (source-diff): Standard Vite build output; minified Vue component bundle, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/install-Bmdyhhbh.js | AI (source-diff): Standard Vite-minified Vue component bundle; readable imports and logic confirm no obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CD4EplxA.js | AI (source-diff): Minified Vue table component; readable imports confirm standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DIbLIafL.js | AI (source-diff): Minified Vue error-page component with inline SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CdSPx66Q.js | AI (source-diff): Minified Vue component with inline SVG data URI; no obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-9hQfRr7G.js | AI (source-diff): Minified emoji-picker component bundle; readable Vue imports and IndexedDB logic. | ai | |
| source-diff | net-exec-file:dist/install-Bmdyhhbh.js | AI (source-diff): Network calls are emoji CDN fetches; dynamic code execution is standard Vue reactivity patterns, not dropper behavior. | ai | |
| source-diff | net-exec-file:dist/install-a-C0Uz5X.js | AI (source-diff): Network call is emoji-picker CDN fetch (jsdelivr); no dynamic code execution beyond normal Vue runtime. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-BWDKZosT.js | AI (source-diff): Minified Vue table component; long lines are normal minifier output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-B4pbqoOI.js | AI (source-diff): Minified Vue error-page component with URL-encoded SVG; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DuLtIKMP.js | AI (source-diff): Minified Vue component with URL-encoded SVG inline data; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CUtTN1q_.js | AI (source-diff): Minified emoji-picker component bundle; long lines are normal minifier output. | ai | |
| source-diff | obfuscated-file:dist/install-a-C0Uz5X.js | AI (source-diff): Standard Vite-minified bundle of Vue UI components; long lines are normal minifier output. | ai | |
| source-diff | net-exec-file:dist/install-BUa1vI9s.js | AI (source-diff): Network call is emoji-picker CDN fetch; dynamic code execution is Vue's runtime rendering — normal UI SDK behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-bC1IdvdS.js | AI (source-diff): Vite-bundled table component with URL-encoded SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DfUOuTIJ.js | AI (source-diff): Vite-bundled error page component with URL-encoded SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-C3F8UALY.js | AI (source-diff): Vite-bundled component with URL-encoded SVG assets; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-5n_9FKhp.js | AI (source-diff): Vite-bundled emoji picker component; minification triggers rule, no malicious content. | ai | |
| source-diff | obfuscated-file:dist/install-BUa1vI9s.js | AI (source-diff): Standard Vite-bundled Vue component output; minification triggers rule but no malicious content. | ai | |
| source-diff | net-exec-file:dist/install-BNNJFRDJ.js | AI (source-diff): Network calls are Vue component data fetches (emoji CDN); no dynamic code execution pattern. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DQtoij8i.js | AI (source-diff): URL-encoded SVG inline data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CJxYSeu-.js | AI (source-diff): URL-encoded SVG inline data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-Bjw8UxPk.js | AI (source-diff): URL-encoded SVG inline data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-B2TUUnF-.js | AI (source-diff): Vite-minified emoji picker component; long lines are bundled output. | ai | |
| source-diff | obfuscated-file:dist/install-BNNJFRDJ.js | AI (source-diff): Standard Vite-minified Vue bundle; long lines are normal for bundled output. | ai | |
| source-diff | net-exec-file:dist/install-BPGa7xcr.js | AI (source-diff): Network calls and dynamic code in Vite bundle are normal Vue/component library patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CqVmODXu.js | AI (source-diff): Minified Vite chunk; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-DzpLr_VF.js | AI (source-diff): Minified Vite chunk with inline SVG data URI; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DVn93O_A.js | AI (source-diff): Minified Vite chunk with inline SVG data URI; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BzJxFQX-.js | AI (source-diff): Minified Vite chunk for emoji-picker component; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/install-BPGa7xcr.js | AI (source-diff): Standard Vite build output (minified Vue component bundle); not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-zL3IkviW.js | AI (source-diff): Minified Vue component with URL-encoded SVG; standard build output. | ai | |
| source-diff | net-exec-file:dist/install-Sbp7aowq.js | AI (source-diff): Network calls are emoji CDN fetch (jsdelivr); no dynamic code execution beyond normal Vue runtime patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BMQfL9X3.js | AI (source-diff): Minified emoji-picker-element bundle; standard build output for this UI SDK. | ai | |
| source-diff | obfuscated-file:dist/install-Sbp7aowq.js | AI (source-diff): Standard Vite-bundled Vue UI library chunk; minified but not obfuscated, readable Vue imports visible. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-Btmg48Xk.js | AI (source-diff): Minified Vue component with URL-encoded SVG; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-D2niYDeI.js | AI (source-diff): Minified Vue component; standard build output for this UI SDK. | ai | |
| source-diff | obfuscated-file:dist/install-rysuPEjF.js | AI (source-diff): Standard Vite bundle chunk; minified Vue component code, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CPacgsbN.js | AI (source-diff): Minified Vite chunk; sample shows standard Vue component with inline SVG. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-Rt-F9oVv.js | AI (source-diff): Minified Vite chunk with inline SVG; normal UI component bundle. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-DHdJccrG.js | AI (source-diff): Minified Vite chunk with inline SVG data URI; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-D_4QMhH7.js | AI (source-diff): Minified Vite chunk for emoji picker component; sample shows legitimate emoji-picker-element IndexedDB code. | ai | |
| source-diff | net-exec-file:dist/install-rysuPEjF.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are normal Vue/fetch patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-C4AY_Nyy.js | AI (source-diff): URL-encoded SVG inline data causes long lines; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-C6Ffq5UN.js | AI (source-diff): URL-encoded SVG inline data causes long lines; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CrbQHj7e.js | AI (source-diff): URL-encoded SVG inline data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-8kgugJp3.js | AI (source-diff): Vite-bundled emoji picker component; minified lines are expected build output. | ai | |
| source-diff | net-exec-file:dist/install-b3LF2l6e.js | AI (source-diff): Network call is emoji-picker-element fetching CDN data; no dynamic code execution beyond normal Vue rendering. | ai | |
| source-diff | obfuscated-file:dist/install-b3LF2l6e.js | AI (source-diff): Standard Vite bundle of Vue components; long lines are minified JS, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BEPJGh0L.js | AI (source-diff): Minified Vite bundle for emoji picker component; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-Bfzt7YQO.js | AI (source-diff): Minified Vite bundle with URL-encoded SVG error page; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DHEaw92W.js | AI (source-diff): Minified Vite bundle; normal build artifact. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publisher with SLSA provenance attestation is a legitimate supply chain improvement. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-TCGzXQUx.js | AI (source-diff): Minified Vite bundle with URL-encoded SVG; normal build artifact. | ai | |
| source-diff | obfuscated-file:dist/install-CrhatfOO.js | AI (source-diff): Standard Vite-minified Vue component bundle; long lines are minified JS, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/install-CrhatfOO.js | AI (source-diff): Network call is emoji data CDN fetch (jsdelivr); no dynamic code execution pattern present. | ai | |
| dependencies | unvetted-peer-dep:jszip-utils | AI (dependencies): Optional peer dep for file handling; already accepted in prior versions. | ai | |
| source-diff | net-exec-file:dist/install-Dq6Xzj7N.js | AI (source-diff): Network calls are emoji-picker CDN data fetches; dynamic execution is Vue runtime patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-1PQXgyFT.js | AI (source-diff): Minified Vite bundle; content is Vue component with URL-encoded SVG. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-Bfl_LRhh.js | AI (source-diff): Minified Vite bundle; content is URL-encoded SVG error page assets. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-C6iAgiXM.js | AI (source-diff): Minified Vite bundle; content is URL-encoded SVG assets and Vue component code. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-DlcRu7FP.js | AI (source-diff): Minified Vite bundle; content is emoji-picker-element component code. | ai | |
| source-diff | obfuscated-file:dist/install-Dq6Xzj7N.js | AI (source-diff): Standard Vite-minified bundle for a Vue UI SDK; long lines are normal bundler output. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-CV2ViLFe.js | AI (source-diff): Minified Vite bundle; standard build output. | ai | |
| source-diff | obfuscated-file:dist/install-BCOGjWv4.js | AI (source-diff): Standard Vite-minified Vue bundle; readable imports from 'vue', no actual obfuscation. | ai | |
| source-diff | net-exec-file:dist/install-BCOGjWv4.js | AI (source-diff): Network calls are CDN fetches for emoji data; no dynamic code execution beyond normal Vue runtime patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BbcSpHw0.js | AI (source-diff): Minified Vite bundle for emoji picker component; readable Vue imports, no obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CmcHeJ67.js | AI (source-diff): Minified Vite bundle with inline SVG data URI; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-zxeVvway.js | AI (source-diff): Minified Vite bundle with inline SVG; standard build output. | ai | |
| dependencies | unvetted-dep:emoji-picker-element | AI (dependencies): emoji-picker-element is a standard web component; aligns with new wt-chat-emoji dist file in this version. | ai | |
| dependencies | unvetted-dep:xlsx | AI (dependencies): xlsx is a widely-used spreadsheet library; its use is consistent with this SDK's file-export functionality. | ai | |
| source-diff | net-exec-file:dist/install-Bd5HfFTV.js | AI (source-diff): Network refs are CDN emoji data URLs; dynamic code is Vue reactivity internals, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DaGMSlL1.js | AI (source-diff): Minified Vue component; standard Vite build output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BMpoQdQl.js | AI (source-diff): Minified Vue component with inline SVG data URIs; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-OrcannPM.js | AI (source-diff): Minified Vue component with inline SVG data URIs; standard build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CUjHxdzV.js | AI (source-diff): Minified emoji-picker-element bundle; expected for this dependency. | ai | |
| source-diff | obfuscated-file:dist/install-Bd5HfFTV.js | AI (source-diff): Standard Vite minified bundle output for a Vue UI SDK; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-IIP3rusg.js | AI (source-diff): Vite-minified lazy chunk; sample shows standard Vue component with inline SVG data URI. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-DrcFp4Wl.js | AI (source-diff): Vite-minified lazy chunk; sample shows standard Vue component imports. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-BF8MnBYQ.js | AI (source-diff): Vite-minified lazy chunk; sample shows standard Vue component with inline SVG data URI. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CcTec-mP.js | AI (source-diff): Vite-minified lazy chunk for emoji picker component; sample shows normal Vue imports. | ai | |
| source-diff | net-exec-file:dist/install-BjjBYpbl.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are normal Vue/browser patterns, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/install-BjjBYpbl.js | AI (source-diff): Standard Vite-minified bundle for a Vue UI SDK; long lines are minified JS, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-D1USdwE4.js | AI (source-diff): URL-encoded SVG data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CCESyhxX.js | AI (source-diff): URL-encoded SVG data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-9EjvdKqd.js | AI (source-diff): URL-encoded SVG data causes long lines; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BpXv6NqV.js | AI (source-diff): Minified emoji-picker-element bundle; readable logic visible in sample. | ai | |
| source-diff | net-exec-file:dist/install-Btsl7J6C.js | AI (source-diff): Network calls are emoji CDN fetches; dynamic code execution is Vue's runtime rendering — no dropper pattern. | ai | |
| source-diff | obfuscated-file:dist/install-Btsl7J6C.js | AI (source-diff): Standard Vite-minified Vue bundle; long lines are normal build output for this UI SDK. | ai | |
| provenance | no-provenance | AI (provenance): Large established SDK; lack of provenance is consistent across its 2000+ version history. | ai | |
| source-diff | net-exec-file:dist/install-uRNiMbqp.js | AI (source-diff): Network call is emoji CDN fetch; no dynamic code execution beyond normal Vue runtime. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-D6LkZ5Mu.js | AI (source-diff): Minified Vue table component; sample shows normal Vue composable patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-CNwzDAa5.js | AI (source-diff): Minified error-page component with URL-encoded SVG; standard build artifact. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-nq43ktii.js | AI (source-diff): Minified Vue component with URL-encoded SVG asset; benign build output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-BlKZydZ3.js | AI (source-diff): Minified emoji-picker component bundle; sample shows IndexedDB/emoji logic, not malware. | ai | |
| source-diff | obfuscated-file:dist/install-uRNiMbqp.js | AI (source-diff): Standard Vite minified bundle; Vue imports and normal JS patterns visible in sample. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-CQoomGSQ.js | AI (source-diff): Minified Vue component with URL-encoded SVG; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-D3oCCDNW.js | AI (source-diff): Minified Vue component; standard Vite output. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-ND0BquL3.js | AI (source-diff): Minified Vue error-page component with URL-encoded SVG; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-CPpRiG3z.js | AI (source-diff): Minified emoji-picker-element bundle; CDN URL for emoji data is documented upstream behavior. | ai | |
| source-diff | net-exec-file:dist/install-BTw4h6La.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are expected (fetch for emoji data, dynamic component loading). | ai | |
| source-diff | obfuscated-file:dist/install-BTw4h6La.js | AI (source-diff): Standard Vite-minified bundle; Vue imports and normal JS patterns visible in sample. | ai | |
| source-diff | obfuscated-file:dist/wt-error-page-BklEfHeX.js | AI (source-diff): URL-encoded SVG paths in a minified Vue component; no malicious content. | ai | |
| source-diff | obfuscated-file:dist/wt-dummy-BCaleMs_.js | AI (source-diff): Contains URL-encoded SVG data and Vue component code; standard minified output. | ai | |
| source-diff | obfuscated-file:dist/wt-chat-emoji-zXNZdzpq.js | AI (source-diff): Minified emoji-picker-element bundle; content matches the declared emoji-picker-element dependency. | ai | |
| source-diff | net-exec-file:dist/install-B0iOKX0v.js | AI (source-diff): Network calls and dynamic code in a UI SDK bundle are expected (fetch for emoji data, dynamic Vue component loading). | ai | |
| source-diff | obfuscated-file:dist/install-B0iOKX0v.js | AI (source-diff): Standard Vite bundle chunk with readable Vue imports; minification triggers the rule but no obfuscation present. | ai | |
| source-diff | obfuscated-file:dist/wt-table-column-select-ClA_A3dE.js | AI (source-diff): Standard Vite-minified Vue component with SVG data; benign. | ai | |
| phantom-deps | phantom-dep:@tailwindcss/vite | AI (phantom-deps): Vite plugin referenced in build config; stable false positive. | ai | |
| phantom-deps | phantom-dep:path-browserify | AI (phantom-deps): Polyfill referenced in build config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@floating-ui/vue | AI (phantom-deps): UI library dep used indirectly via component wrappers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vuepic/vue-datepicker | AI (phantom-deps): Lazily imported UI component; stable false positive. | ai | |
| phantom-deps | phantom-dep:@morev/vue-transitions | AI (phantom-deps): Lazily imported UI component; stable false positive. | ai | |
| phantom-deps | phantom-dep:emoji-picker-element | AI (phantom-deps): Lazily imported UI component; stable false positive. | ai | |
| phantom-deps | phantom-dep:autosize | AI (phantom-deps): Build-tool/config reference in a large UI SDK; stable false positive. | ai | |
| phantom-deps | phantom-dep:tailwindcss | AI (phantom-deps): Referenced in vite/tailwind config files, not a runtime import; stable false positive. | ai |
Versions (showing 100 of 126)
| Version | Deps | Published |
|---|---|---|
| 26.6.101 | 23 / 46 | |
| 26.6.86 | 23 / 46 | |
| 26.6.82 | 23 / 46 | |
| 26.6.80 | 23 / 46 | |
| 26.6.67 | 23 / 46 | |
| 26.6.58 | 22 / 46 | |
| 26.6.51 | 22 / 46 | |
| 26.6.44 | 22 / 46 | |
| 26.6.43 | 22 / 46 | |
| 26.6.41 | 22 / 46 | |
| 26.6.28 | 22 / 46 | |
| 26.6.24 | 22 / 46 | |
| 26.6.23 | 22 / 46 | |
| 26.6.22 | 22 / 46 | |
| 26.6.20 | 22 / 46 | |
| 26.6.19 | 22 / 46 | |
| 26.6.18 | 22 / 46 | |
| 26.6.17 | 22 / 46 | |
| 26.6.16 | 22 / 46 | |
| 26.6.15 | 22 / 46 | |
| 26.6.13 | 22 / 46 | |
| 26.6.12 | 22 / 46 | |
| 26.6.11 | 22 / 46 | |
| 26.6.10 | 22 / 46 | |
| 26.6.9 | 22 / 46 | |
| 26.6.8 | 22 / 46 | |
| 26.6.7 | 22 / 46 | |
| 26.6.6 | 22 / 46 | |
| 26.6.4 | 22 / 46 | |
| 26.6.3 | 22 / 46 | |
| 26.6.2 | 22 / 46 | |
| 26.6.1 | 22 / 46 | |
| 26.4.90 | 22 / 46 | |
| 26.4.87 | 22 / 46 | |
| 26.4.86 | 22 / 46 | |
| 26.4.84 | 22 / 46 | |
| 26.4.83 | 22 / 46 | |
| 26.4.82 | 22 / 46 | |
| 26.4.81 | 22 / 46 | |
| 26.4.80 | 22 / 46 | |
| 26.4.79 | 22 / 46 | |
| 26.4.78 | 22 / 46 | |
| 26.4.77 | 22 / 46 | |
| 26.4.76 | 22 / 46 | |
| 26.4.73 | 22 / 46 | |
| 26.4.72 | 22 / 46 | |
| 26.4.71 | 22 / 46 | |
| 26.4.70 | 22 / 46 | |
| 26.4.68 | 22 / 46 | |
| 26.4.67 | 22 / 46 | |
| 26.4.66 | 22 / 46 | |
| 26.4.64 | 22 / 46 | |
| 26.4.63 | 22 / 46 | |
| 26.4.62 | 22 / 46 | |
| 26.4.61 | 22 / 46 | |
| 26.4.60 | 22 / 46 | |
| 26.4.59 | 22 / 46 | |
| 26.4.58 | 22 / 46 | |
| 26.4.57 | 22 / 46 | |
| 26.4.56 | 22 / 46 | |
| 26.4.55 | 22 / 46 | |
| 26.4.54 | 22 / 46 | |
| 26.4.53 | 22 / 46 | |
| 26.4.51 | 22 / 46 | |
| 26.4.50 | 22 / 46 | |
| 26.4.49 | 22 / 46 | |
| 26.4.47 | 22 / 46 | |
| 26.4.46 | 22 / 46 | |
| 26.4.45 | 22 / 46 | |
| 26.4.44 | 22 / 46 | |
| 26.4.43 | 22 / 46 | |
| 26.4.42 | 22 / 46 | |
| 26.4.41 | 22 / 46 | |
| 26.4.40 | 22 / 46 | |
| 26.4.39 | 22 / 46 | |
| 26.4.38 | 22 / 46 | |
| 26.4.37 | 22 / 46 | |
| 26.4.36 | 22 / 46 | |
| 26.4.35 | 22 / 46 | |
| 26.4.34 | 22 / 46 | |
| 26.4.33 | 22 / 46 | |
| 26.4.32 | 22 / 46 | |
| 26.4.31 | 22 / 46 | |
| 26.4.29 | 22 / 46 | |
| 26.4.28 | 22 / 46 | |
| 26.4.26 | 22 / 46 | |
| 26.4.25 | 22 / 46 | |
| 26.4.23 | 22 / 46 | |
| 26.4.22 | 22 / 46 | |
| 26.4.21 | 22 / 46 | |
| 26.4.20 | 22 / 46 | |
| 26.4.18 | 22 / 46 | |
| 26.4.16 | 22 / 45 | |
| 26.4.14 | 22 / 45 | |
| 26.4.13 | 22 / 45 | |
| 26.4.10 | 22 / 45 | |
| 26.2.145 | 22 / 45 | |
| 26.2.144 | 22 / 45 | |
| 26.2.15 | 23 / 49 | |
| 26.2.10 | 41 / 45 |
Showing 100 of 126
Next page →
v26.6.101
3 findings
HIGH
New obfuscated file: dist/components-B15PvOcM.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-chat-emoji-DGWoMhRa.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.6.86
3 findings
HIGH
New obfuscated file: dist/components-DaDed2hn.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-chat-emoji-T8LDtZS-.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.6.82
3 findings
HIGH
New obfuscated file: dist/components-rPVG1iQS.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-chat-emoji-DnG7Ikl3.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.6.80
5 findings
HIGH
New obfuscated file: dist/components-B78RTsRa.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-chat-emoji-D3pE1OO5.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-icon-y89gRcOs.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-table-column-select-CgEh5BAF.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.6.67
3 findings
HIGH
New obfuscated file: dist/components-rjTUkhKS.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-chat-emoji-C1Ps8-7X.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v26.4.54
7 findings
HIGH
New obfuscated file: dist/install-Dy8FCdqU.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New file with network + code execution: dist/install-Dy8FCdqU.js
source-diff
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
HIGH
New obfuscated file: dist/wt-chat-emoji-9F6nz7-q.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-dummy-D3x4x6Fp.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-error-page-BEZxsYXU.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
HIGH
New obfuscated file: dist/wt-table-column-select-Ss5cVY7U.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v26.2.15
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v26.2.10
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.