← Home

troika-three-text

53
Versions
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

lojjic

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:libs/unicode-font-resolver-client.factory.js AI (source-diff): Rollup-bundled vendor lib with license banner; documented build step, benign minification. ai
npm-metadata url-dep:@fredli74/typr AI (npm-metadata): devDependency pinned to maintainer's own Typr.ts fork; build-time only, not runtime. ai
source-diff obfuscated-file-transition:libs/opentype.factory.js AI (source-diff): Rollup-minified opentype.js build, license banner intact; benign for this package. ai
source-diff obfuscated-file-transition:libs/typr.factory.js AI (source-diff): Rollup-minified Typr.ts build; benign build output. ai
source-diff obfuscated-file-transition:libs/woff2otf.factory.js AI (source-diff): Rollup-minified woff2otf+tiny-inflate build; benign. ai
email-domain unclaimed-email:protectwise.com AI (email-domain): Legacy company-domain email on a long-established trusted package; not a per-version malicious signal. ai
provenance no-provenance AI (provenance): troika-three-text is a long-established package (2118 days, 61 versions) from a known monorepo; lack of Sigstore provenance is not a meaningful risk signal here. ai
dependencies unvetted-dep:webgl-sdf-generator AI (dependencies): webgl-sdf-generator is a pinned dependency (1.1.1) used for SDF font rendering, consistent with the package's documented purpose; no adverse signals. ai
dependencies unvetted-dep:troika-three-utils AI (dependencies): troika-three-utils is a sibling package in the same troika monorepo, published by the same author with matching version cadence; not a third-party risk. ai
dependencies unvetted-dep:troika-worker-utils AI (dependencies): troika-worker-utils is a sibling package in the same troika monorepo, published by the same author with matching version cadence; not a third-party risk. ai

Versions (showing 53 of 53)

Version Deps Published
0.53.0 4 / 4
0.52.5 4 / 4
0.52.4 4 / 4
0.52.3 4 / 4
0.52.2 4 / 4
0.52.1 4 / 4
0.52.0 4 / 4
0.51.1 4 / 4
0.51.0 4 / 4
0.50.3 4 / 4
0.50.2 4 / 4
0.50.1 4 / 4
0.50.0 4 / 4
0.49.1 4 / 4
0.49.0 4 / 4
0.48.1 4 / 4
0.48.0 4 / 4
0.47.2 4 / 3
0.47.1 4 / 3
0.47.0 4 / 3
0.46.4 4 / 3
0.46.3 4 / 3
0.46.2 4 / 3
0.46.1 4 / 3
0.46.0 4 / 3
0.45.1 3 / 4
0.45.0 3 / 4
0.44.0 3 / 4
0.43.0 3 / 4
0.42.0 3 / 4
0.41.2 3 / 4
0.41.1 3 / 4
0.41.0 3 / 4
0.40.0 2 / 4
0.39.2 2 / 4
0.39.1 2 / 4
0.39.0 2 / 4
0.38.1 2 / 4
0.38.0 2 / 4
0.37.0 2 / 4
0.36.1 2 / 4
0.36.0 2 / 4
0.35.0 2 / 2
0.34.2 2 / 2
0.34.1 2 / 2
0.34.0 2 / 2
0.33.1 2 / 2
0.32.0 2 / 2
0.31.0 2 / 2
0.30.2 2 / 2
0.30.1 2 / 2
0.30.0 2 / 2
0.29.0 2 / 2

v0.53.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.3

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.52.2

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.52.1

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.52.0

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.51.1

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.51.0

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.50.3

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.50.2

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.50.1

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.50.0

2 findings
HIGH Unclaimed maintainer email domain: protectwise.com email-domain

Maintainer email '[email protected]' uses domain 'protectwise.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.49.1

4 findings
HIGH New obfuscated file: libs/unicode-font-resolver-client.factory.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.49.0

4 findings
HIGH New obfuscated file: libs/unicode-font-resolver-client.factory.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.1

4 findings
HIGH New obfuscated file: libs/unicode-font-resolver-client.factory.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.48.0

4 findings
HIGH New obfuscated file: libs/unicode-font-resolver-client.factory.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.2

3 findings
HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.1

3 findings
HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.0

3 findings
HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.4

3 findings
HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.3

3 findings
HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.2

4 findings
HIGH SHA-pinned github dependency (devDependencies): @fredli74/typr npm-metadata

Dependency '@fredli74/typr' in `devDependencies` points to 'git+https://github.com/lojjic/Typr.ts.git#2c559388431499f67c6c1b50c9eb68d057e47092' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.1

4 findings
HIGH SHA-pinned github dependency (devDependencies): @fredli74/typr npm-metadata

Dependency '@fredli74/typr' in `devDependencies` points to 'git+https://github.com/lojjic/Typr.ts.git#2c559388431499f67c6c1b50c9eb68d057e47092' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.46.0

4 findings
HIGH SHA-pinned github dependency (devDependencies): @fredli74/typr npm-metadata

Dependency '@fredli74/typr' in `devDependencies` points to 'git+https://github.com/lojjic/Typr.ts.git#2c559388431499f67c6c1b50c9eb68d057e47092' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.1

5 findings
HIGH SHA-pinned github dependency (devDependencies): @fredli74/typr npm-metadata

Dependency '@fredli74/typr' in `devDependencies` points to 'git+https://github.com/lojjic/Typr.ts.git#2c559388431499f67c6c1b50c9eb68d057e47092' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.45.0

5 findings
HIGH SHA-pinned github dependency (devDependencies): @fredli74/typr npm-metadata

Dependency '@fredli74/typr' in `devDependencies` points to 'git+https://github.com/lojjic/Typr.ts.git#2c559388431499f67c6c1b50c9eb68d057e47092' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.44.0

5 findings
HIGH SHA-pinned github dependency (devDependencies): @fredli74/typr npm-metadata

Dependency '@fredli74/typr' in `devDependencies` points to 'git+https://github.com/lojjic/Typr.ts.git#2c559388431499f67c6c1b50c9eb68d057e47092' instead of a registry version. URL dependencies bypass the registry and can be swapped at any time. A 40-character commit SHA in a dependency URL is a strong supply-chain signal — the 2026-05-11 TanStack/Mini Shai-Hulud attack used this exact shape in `optionalDependencies` to smuggle a malicious payload past lifecycle-script and OSV checks.

HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.43.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.42.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.41.2

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.41.1

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.41.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.40.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.2

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.1

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.39.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.1

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.38.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.37.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.1

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.0

4 findings
HIGH Modified file became obfuscated: libs/opentype.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/typr.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

HIGH Modified file became obfuscated: libs/woff2otf.factory.js source-diff

This file was readable in the previously greenflagged version and is now minified or obfuscated (lines over 3000 chars). A file that gains obfuscation between releases is a strong payload-swap indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.35.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.32.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.31.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.30.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.29.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.