cesium
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:Build/CesiumUnminified/index.cjs | AI (source-diff): Base64-encoded inline workers; standard CesiumJS build pattern. | ai | |
| source-diff | encoded-string-file:Build/CesiumUnminified/Cesium.js | AI (source-diff): atob() of inline workers bundle; documented CesiumJS build artifact. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Chunk-hashed worker files rotate names each release; stable for CesiumJS. | ai | |
| source-diff | encoded-string-file:Build/Cesium/index.cjs | AI (source-diff): GLSL shader strings and minified build output; stable pattern for CesiumJS. | ai | |
| source-diff | encoded-string-file:Build/Cesium/Cesium.js | AI (source-diff): atob() of inline workers bundle; documented CesiumJS build artifact. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Prod/dev conditional require in index.cjs is a well-known pattern; paths are static strings, not user input. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires inside bundled KTX2 transcoder worker; standard pattern in Cesium's build output, not user-controlled input. | ai |
v1.142.0
5 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.141.0
6 findingsThis version was published by a different npm account than previous versions on 2026-05-01. This could indicate a legitimate maintainer transition or an account compromise.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.