magicast
Modify a JS/TS file and write back magically just like JSON!
25
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
pi0antfu
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is a namespace-reservation stub by trusted publisher antfu; not a malware indicator for this package. | ai | |
| source-diff | net-exec-file:dist/builders-mk_DIY8_.js | AI (source-diff): Rolldown bundle of recast/ast-types; standard AST tooling, not malware. | ai | |
| source-diff | net-exec-file:dist/builders-hKD4IrLX.js | AI (source-diff): Rolldown/tsdown bundle of recast+ast-types+babel; CJS interop shims trigger false positive. No actual network calls. | ai | |
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation which supersedes gitHead. Missing gitHead is consistent with GitHub Actions CI/CD publish flow. | ai | |
| phantom-deps | phantom-dep:source-map-js | AI (phantom-deps): source-map-js is a declared dependency; referenced via resolutions alias (source-map -> source-map-js). Not a real phantom dep. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): pi0 (Pooya Parsa) is a core UnJS maintainer; addition is expected for this org's package. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate transfer within UnJS org: antfu → pi0, both are core UnJS maintainers. | ai | |
| phantom-deps | phantom-dep:@types/estree | AI (phantom-deps): @types/estree is a type-only dep re-exported for consumers; not directly imported at runtime. | ai | |
| source-diff | net-exec-file:dist/builders-B_BPSg0Q.js | AI (source-diff): Large bundled build artifact from rolldown/tsdown containing vendored ast-types and babel parser. Network+exec signals are false positives from module interop boilerplate and AST URL strings, not actual network calls or eval. | ai | |
| bogus-package | bogus-package | AI (bogus-package): pi0 and antfu are prominent unjs/Vue ecosystem maintainers; spam flag is a systematic false positive for prolific legitimate publishers. No keywords is cosmetic. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 0.5.3 | 3 / 20 | |
| 0.5.2 | 3 / 20 | |
| 0.5.1 | 3 / 20 | |
| 0.5.0 | 3 / 20 | |
| 0.4.0 | 3 / 19 | |
| 0.3.5 | 3 / 18 | |
| 0.3.4 | 3 / 18 | |
| 0.3.3 | 3 / 18 | |
| 0.3.2 | 3 / 18 | |
| 0.3.1 | 3 / 18 | |
| 0.3.0 | 3 / 18 | |
| 0.2.11 | 3 / 12 | |
| 0.2.10 | 3 / 12 | |
| 0.2.9 | 3 / 12 | |
| 0.2.8 | 3 / 12 | |
| 0.2.7 | 3 / 12 | |
| 0.2.6 | 3 / 12 | |
| 0.2.5 | 3 / 12 | |
| 0.2.4 | 3 / 12 | |
| 0.2.3 | 3 / 10 | |
| 0.2.2 | 3 / 10 | |
| 0.2.1 | 3 / 9 | |
| 0.2.0 | 3 / 9 | |
| 0.1.1 | 3 / 9 | |
| 0.0.0 | 0 / 0 |