lottie-web
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:obfuscation-packer | AI (semgrep): Packer pattern is bundled sylvester.js 3rd-party math lib; stable FP. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Documented After Effects expression evaluator; stable across versions. | ai | |
| source-diff | net-exec-file-transition:build/player/lottie_light.min.js | AI (source-diff): Minified sibling of lottie_light.js; same benign expression-engine pattern. | ai | |
| source-diff | net-exec-file-transition:build/player/lottie_light.js | AI (source-diff): Lottie player bundle; network+eval are the documented expression engine, no hostile destination. | ai | |
| provenance | no-provenance | AI (provenance): Established Airbnb package with 89 versions and 3000+ day history. Lack of Sigstore provenance is common and not a risk signal here. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in ExpressionManager.js is a documented, intentional feature for evaluating After Effects expressions embedded in Lottie animation files. Stable design choice across all versions. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used only in tasks/watch.js, a dev build task file. Not part of the runtime bundle. Benign for this package. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 5.13.0 | 0 / 18 | |
| 5.4.2 | 0 / 18 | |
| 5.4.1 | 0 / 18 | |
| 5.4.0 | 0 / 18 | |
| 5.3.4 | 0 / 18 | |
| 5.3.3 | 0 / 18 | |
| 5.3.2 | 0 / 18 | |
| 5.3.1 | 0 / 18 | |
| 5.2.1 | 0 / 18 | |
| 5.2.0 | 0 / 18 | |
| 5.1.20 | 0 / 18 | |
| 5.1.7 | 0 / 19 | |
| 5.1.6 | 0 / 19 | |
| 5.1.5 | 0 / 19 | |
| 5.1.4 | 0 / 19 | |
| 5.1.3 | 0 / 19 | |
| 5.1.2 | 0 / 19 | |
| 5.1.1 | 0 / 19 | |
| 5.1.0 | 0 / 19 | |
| 5.0.6 | 0 / 17 | |
| 5.0.5 | 0 / 17 | |
| 5.0.4 | 0 / 17 | |
| 5.0.3 | 0 / 17 | |
| 5.0.2 | 0 / 17 | |
| 5.0.1 | 0 / 17 |
v5.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.2
3 findingsThis file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
This file did not combine network calls with dynamic code execution in the previously greenflagged version, and now does. Gaining both halves in an existing file is a hallmark of a dropper/loader introduced by an update.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.6
2 findingsJavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected Source: https://github.com/airbnb/lottie-web/blob/fc162941742a240092ebe0d2f293baec7b6922be/player/js/3rd_party/sylvester.js#L1 > 1 | eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.5
2 findingsJavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected Source: https://github.com/airbnb/lottie-web/blob/b6ef698511b71415256ec1bc1a0359468c1b0abc/player/js/3rd_party/sylvester.js#L1 > 1 | eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.4
2 findingsJavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected Source: https://github.com/airbnb/lottie-web/blob/d62e9451db7642660fc496a431bcd6cb53915ab2/player/js/3rd_party/sylvester.js#L1 > 1 | eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.3
2 findingsJavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected Source: https://github.com/airbnb/lottie-web/blob/c7a61af2986a6366394b5747c8256890c27a6636/player/js/3rd_party/sylvester.js#L1 > 1 | eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.2
2 findingsJavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected Source: https://github.com/airbnb/lottie-web/blob/51e1120f91ab9eb5dada109453747ccfb3580127/player/js/3rd_party/sylvester.js#L1 > 1 | eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
2 findingsJavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected Source: https://github.com/airbnb/lottie-web/blob/6afb6ea15e880c49350f09e8cfb267f2b4ce54a7/player/js/3rd_party/sylvester.js#L1 > 1 | eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.