color-space
Collection of color space conversions
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Decodes the package's own inlined WASM module at runtime. | ai | |
| source-diff | encoded-string-file:dist/color-space.min.js | AI (source-diff): Minified bundle output from esbuild; benign. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): color-space.wasm is the package's own color-conversion kernel. | ai | |
| source-diff | obfuscated-file:wasm/binary.js | AI (source-diff): Base64-inlined WASM color kernel generated by build:wasm; matches stated function. | ai | |
| source-diff | obfuscated-file:spaces/munsell-renotation.js | AI (source-diff): Packed Munsell renotation lookup table with documented format; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/color-space-gl.js | AI (source-diff): esbuild bundle of GL chunks; readable GLSL source. | ai | |
| source-diff | encoded-string-file:dist/color-space.js | AI (source-diff): Long string is packed Munsell color data in bundle output. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainer 'dy' is the same author under a different npm handle, with a clean 2464-day track record. No compromise indicators. | ai | |
| provenance | publisher-changed | AI (provenance): dfcreative and dy appear to be the same person (Dmitry Ivanov); dy has a long, clean npm track record (91 approved, 0 rejected, 2464 days). Legitimate account transition. | ai |
Versions (showing 51 of 56)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 0 / 14 | |
| 2.3.2 | 0 / 3 | |
| 2.3.1 | 0 / 3 | |
| 2.3.0 | 0 / 2 | |
| 2.2.0 | 0 / 3 | |
| 2.1.1 | 0 / 3 | |
| 2.1.0 | 0 / 6 | |
| 2.0.1 | 0 / 4 | |
| 2.0.0 | 0 / 4 | |
| 1.16.0 | 2 / 5 | |
| 1.15.0 | 2 / 5 | |
| 1.14.7 | 2 / 5 | |
| 1.14.6 | 2 / 5 | |
| 1.14.5 | 2 / 5 | |
| 1.14.4 | 2 / 5 | |
| 1.14.3 | 3 / 5 | |
| 1.14.2 | 3 / 5 | |
| 1.14.1 | 3 / 5 | |
| 1.14.0 | 3 / 5 | |
| 1.13.0 | 2 / 5 | |
| 1.12.0 | 3 / 3 | |
| 1.11.2 | 3 / 3 | |
| 1.11.0 | 3 / 3 | |
| 1.10.0 | 3 / 3 | |
| 1.9.0 | 3 / 3 | |
| 1.8.0 | 3 / 3 | |
| 1.7.0 | 3 / 3 | |
| 1.6.0 | 3 / 3 | |
| 1.5.0 | 3 / 3 | |
| 1.4.1 | 3 / 3 | |
| 1.3.1 | 2 / 6 | |
| 1.3.0 | 2 / 6 | |
| 1.2.1 | 1 / 7 | |
| 1.2.0 | 1 / 7 | |
| 1.1.3 | 1 / 7 | |
| 1.1.2 | 1 / 7 | |
| 1.1.1 | 1 / 7 | |
| 1.1.0 | 1 / 7 | |
| 1.0.4 | 1 / 7 | |
| 1.0.3 | 1 / 7 | |
| 1.0.2 | 1 / 7 | |
| 1.0.1 | 1 / 7 | |
| 1.0.0 | 1 / 7 | |
| 0.5.1 | 1 / 7 | |
| 0.5.0 | 1 / 7 | |
| 0.4.0 | 1 / 7 | |
| 0.3.3 | 0 / 7 | |
| 0.3.2 | 0 / 7 | |
| 0.3.1 | 0 / 7 | |
| 0.3.0 | 0 / 7 | |
| 0.2.1 | 0 / 7 |
v3.0.0
7 findingsPackage contains compiled binaries that could be backdoors: • dist/color-space.wasm
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.