search-index
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Established maintainer resuming active maintenance of a long-running library. | ai | |
| source-diff | obfuscated-file:dist/search-index-6.0.0.js | AI (source-diff): Webpack-bundled dist output, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/search-index-6.0.0.js | AI (source-diff): Bundled leveldb/network code from deps, not a dropper. | ai | |
| source-diff | obfuscated-file:dist/search-index-esm-6.0.0.js | AI (source-diff): Webpack-bundled ESM dist output. | ai | |
| source-diff | net-exec-file:dist/search-index-esm-6.0.0.js | AI (source-diff): Bundled leveldb/network code from deps, not a dropper. | ai | |
| dependencies | unvetted-dep:term-vector | AI (dependencies): Author's own ecosystem package; consistent with search-index's long history of using these deps. | ai | |
| dependencies | unvetted-dep:fergies-inverted-index | AI (dependencies): Author's own core dependency (fergies = fergiemcdowall); stable part of this package's architecture. | ai | |
| dependencies | unvetted-dep:ngraminator | AI (dependencies): Author's own ecosystem package; consistent with search-index's long history of using these deps. | ai | |
| phantom-deps | phantom-dep:charwise | AI (phantom-deps): charwise is a declared runtime dep used in config/encoding context; phantom-dep heuristic false positive for this package. | ai |
v6.0.0
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.