numcodecs
Buffer compression and transformation codecs for use in data storage and communication applications.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/zstd.js | AI (source-diff): WASM loader pattern misdetected as net+exec; no real network exfil. | ai | |
| source-diff | net-exec-file:dist/lz4.js | AI (source-diff): WASM loader pattern misdetected as net+exec; no real network exfil. | ai | |
| source-diff | net-exec-file:dist/blosc.js | AI (source-diff): WASM loader pattern misdetected as net+exec; no real network exfil. | ai | |
| source-diff | net-exec-file:blosc.js | AI (source-diff): WASM module loader fetch/instantiate pattern, not dropper behavior. | ai | |
| source-diff | obfuscated-file:zstd.js | AI (source-diff): Emscripten WASM glue code, not obfuscation. | ai | |
| source-diff | obfuscated-file:lz4.js | AI (source-diff): Emscripten WASM glue code, not obfuscation. | ai | |
| source-diff | obfuscated-file:blosc.js | AI (source-diff): Emscripten WASM glue code, not obfuscation. | ai | |
| source-diff | net-exec-file:zstd.js | AI (source-diff): WASM module loader fetch/instantiate pattern, not dropper behavior. | ai | |
| source-diff | net-exec-file:lz4.js | AI (source-diff): WASM module loader fetch/instantiate pattern, not dropper behavior. | ai | |
| source-diff | obfuscated-file:dist/lz4.js | AI (source-diff): Emscripten/WASM glue for lz4 codec, matches package purpose. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): fflate is a well-known, established compression dependency. | ai | |
| source-diff | obfuscated-file:dist/blosc.js | AI (source-diff): Emscripten/WASM glue for blosc codec, matches package purpose. | ai | |
| source-diff | obfuscated-file:dist/zstd.js | AI (source-diff): Emscripten/WASM glue for zstd codec, matches package purpose. | ai | |
| source-diff | obfuscated-file:blosc.cjs | AI (source-diff): Emscripten WASM glue code, minified not obfuscated; matches codec's native binding purpose. | ai | |
| source-diff | net-exec-file:blosc.cjs | AI (source-diff): WebAssembly instantiation via new Function, not a network dropper. | ai | |
| source-diff | obfuscated-file:blosc.mjs | AI (source-diff): Same emscripten wasm loader as .cjs variant. | ai | |
| source-diff | net-exec-file:blosc.mjs | AI (source-diff): WASM loader pattern, not exfil/dropper. | ai | |
| source-diff | obfuscated-file:zstd.cjs | AI (source-diff): Emscripten wasm loader, same pattern as blosc. | ai | |
| source-diff | net-exec-file:zstd.cjs | AI (source-diff): WASM loader, not exfil. | ai | |
| source-diff | obfuscated-file:zstd.mjs | AI (source-diff): Emscripten wasm loader. | ai | |
| source-diff | net-exec-file:zstd.mjs | AI (source-diff): WASM loader, not exfil. | ai | |
| source-diff | obfuscated-file:lz4.cjs | AI (source-diff): Same emscripten codec pattern. | ai | |
| source-diff | net-exec-file:lz4.cjs | AI (source-diff): WASM loader, not exfil. | ai | |
| source-diff | obfuscated-file:lz4.mjs | AI (source-diff): Same emscripten codec pattern. | ai | |
| source-diff | net-exec-file:lz4.mjs | AI (source-diff): WASM loader, not exfil. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): WASM instantiation pattern inside emscripten glue, standard for this codec library. | ai | |
| phantom-deps | phantom-dep:pako | AI (phantom-deps): pako is bundled into dist build, not directly imported in source. | ai | |
| source-diff | obfuscated-file-transition:dist/index-4ac424c6.mjs | AI (source-diff): Bundler output transition to minified pako code, not a payload swap. | ai | |
| source-diff | obfuscated-file:dist/index-923bc443.js | AI (source-diff): Minified pako/zlib bundle, not true obfuscation; matches package's compression purpose. | ai | |
| source-diff | obfuscated-file:dist/index-7dc54635.cjs | AI (source-diff): Minified pako/zlib bundle, not true obfuscation; matches package's compression purpose. | ai | |
| source-diff | obfuscated-file:dist/types/codecs/blosc/blosc_codec_wasm.d.ts | AI (source-diff): Base64 wasm constant embedded in TS type declarations, not obfuscated code. | ai | |
| source-diff | net-exec-file:dist/blosc.mjs | AI (source-diff): Same false-positive WASM pattern as .cjs. | ai | |
| source-diff | obfuscated-file:dist/blosc.mjs | AI (source-diff): Same Emscripten loader as .cjs variant. | ai | |
| source-diff | net-exec-file:dist/blosc.cjs | AI (source-diff): WASM instantiation misdetected as net+exec; no network calls to remote hosts. | ai | |
| source-diff | obfuscated-file:dist/blosc.cjs | AI (source-diff): Emscripten WASM loader boilerplate, not obfuscation. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Legit initial version of a long-standing, high-download package; not a throwaway. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 0.3.2 | 1 / 8 | |
| 0.3.1 | 1 / 8 | |
| 0.3.0 | 1 / 8 | |
| 0.2.2 | 0 / 11 | |
| 0.2.1 | 0 / 11 | |
| 0.2.0 | 0 / 11 | |
| 0.1.1 | 1 / 15 | |
| 0.1.0 | 1 / 15 | |
| 0.0.15 | 1 / 15 | |
| 0.0.14 | 1 / 15 | |
| 0.0.13 | 1 / 15 | |
| 0.0.12 | 1 / 15 | |
| 0.0.11 | 1 / 14 | |
| 0.0.1 | 1 / 14 | |
| 0.0.0 | 1 / 16 |
v0.3.1
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
8 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: manzt.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
14 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: manzt.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
14 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: manzt.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.1
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.15
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.14
6 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.13
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.