maplibre-gl
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/maplibre-gl-worker-dev.mjs | AI (source-diff): Tile-fetching worker, expected network+parse behavior. | ai | |
| source-diff | obfuscated-file:dist/maplibre-gl.mjs | AI (source-diff): Minified rolldown build output of a legit library, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/maplibre-gl-dev.mjs | AI (source-diff): Bundled dev build output, license banner intact. | ai | |
| source-diff | obfuscated-file:dist/maplibre-gl-shared.mjs | AI (source-diff): Minified shared bundle, benign. | ai | |
| source-diff | obfuscated-file:dist/maplibre-gl-shared-dev.mjs | AI (source-diff): Bundled shared dev output. | ai | |
| source-diff | obfuscated-file:dist/maplibre-gl-worker.mjs | AI (source-diff): Minified worker bundle. | ai | |
| source-diff | net-exec-file:dist/maplibre-gl-worker.mjs | AI (source-diff): Worker fetches map tiles per stated function; no hostile target. | ai | |
| provenance | publisher-changed | AI (provenance): Manual→CI/CD transition with SLSA attestation on canonical maplibre package; benign automation handoff. | ai | |
| phantom-deps | phantom-dep:@types/geojson-vt | AI (phantom-deps): Type-only dep loaded by convention; stable FP. | ai | |
| phantom-deps | phantom-dep:@types/supercluster | AI (phantom-deps): Type-only dep loaded by convention; stable FP. | ai | |
| phantom-deps | phantom-dep:@types/geojson | AI (phantom-deps): Type-only package loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@mapbox/jsonlint-lines-primitives | AI (phantom-deps): Referenced in config files; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:quickselect | AI (phantom-deps): Bundled dependency; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 6.0.0 | 17 / 82 | |
| 5.24.0 | 19 / 90 | |
| 5.23.0 | 19 / 90 | |
| 5.22.0 | 19 / 90 | |
| 5.21.1 | 19 / 91 | |
| 5.21.0 | 19 / 91 | |
| 5.20.2 | 19 / 90 | |
| 5.20.1 | 19 / 90 | |
| 5.20.0 | 19 / 90 | |
| 5.19.0 | 22 / 90 | |
| 5.18.0 | 22 / 90 | |
| 5.17.0 | 22 / 90 | |
| 5.16.0 | 23 / 90 | |
| 5.15.0 | 23 / 90 | |
| 5.14.0 | 23 / 90 | |
| 5.13.0 | 23 / 90 | |
| 5.12.0 | 23 / 90 | |
| 5.11.0 | 22 / 88 |
v6.0.0
8 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.21.1
2 findingsThis version was published by a different npm account than previous versions on 2026-03-25. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.21.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.2
2 findingsThis version was published by a different npm account than previous versions on 2026-03-17. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.1
2 findingsThis version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.20.0
2 findingsThis version was published by a different npm account than previous versions on 2026-03-10. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.19.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-23. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.18.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-10. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.17.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-27. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.16.0
2 findingsThis version was published by a different npm account than previous versions on 2026-01-12. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.15.0
2 findingsThis version was published by a different npm account than previous versions on 2025-12-17. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.14.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.