vod-js-sdk-v6

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (superjolly) than the most recent previously approved version (alsotang) on 2023-11-13. It has since remained available on npm for 981 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2023-07-26. It has since remained available on npm for 1091 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2023-02-06. It has since remained available on npm for 1261 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2023-02-03. It has since remained available on npm for 1264 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2022-08-09. It has since remained available on npm for 1442 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2022-08-09. It has since remained available on npm for 1442 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2022-08-05. It has since remained available on npm for 1446 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2022-05-16. It has since remained available on npm for 1527 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (tencent-player) than the most recent previously approved version (alsotang) on 2022-04-08. It has since remained available on npm for 1565 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (_windmill) than the most recent previously approved version (alsotang) on 2021-05-27. It has since remained available on npm for 1881 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (_windmill) than the most recent previously approved version (alsotang) on 2020-10-16. It has since remained available on npm for 2104 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (_windmill) than the most recent previously approved version (alsotang) on 2020-08-07. It has since remained available on npm for 2174 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (_windmill) than the most recent previously approved version (alsotang) on 2020-08-03. It has since remained available on npm for 2178 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

This version was published by a different npm account (_windmill) than the most recent previously approved version (alsotang) on 2019-12-18. It has since remained available on npm for 2407 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/b9b6ae4aa1ef9a0331d4b7c0b9dd6b38b6dc0bda/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/4062fb96f9534d15dda7213e977346fdecff5d64/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/ef3f8e6f80bd56132f9dd7cc90cfa5033a409710/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/37d93b9875ad412aace7e8c5b3d9645cc6670fd4/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d7f590d2855884e833fa2059ec4568b8e5f631a7/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d877209ceaff2bb99bfa53c1e7398fa952a0b7cd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/7d45870e4a91f3ac747cf80900ea16f819b51fc9/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/93bef43f4e2ea29808a3b88cd6bde4d3468059bd/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package contains compiled binaries that could be backdoors: • docs/import-demo/node_modules/fsevents/lib/binding/Release/node-v67-darwin-x64/fse.node

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

The directory `docs/import-demo/node_modules/@webassemblyjs/ast` byte-matched 33 of 34 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/ast/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/browserify-aes` byte-matched 21 of 22 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/browserify-aes/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/crypto-browserify` byte-matched 20 of 21 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/crypto-browserify/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/fast-json-stable-stringify` byte-matched 15 of 16 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/fast-json-stable-stringify/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/querystring` byte-matched 14 of 15 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/querystring/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/wast-parser` byte-matched 12 of 13 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/wast-parser/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/utf8` byte-matched 11 of 12 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/utf8/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/helper-wasm-section` byte-matched 9 of 10 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/helper-wasm-section/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/leb128` byte-matched 9 of 10 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/leb128/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/browserify-zlib` byte-matched 9 of 10 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/browserify-zlib/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/wasm-parser` byte-matched 8 of 9 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/wasm-parser/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/atob` byte-matched 8 of 9 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/atob/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/json-schema-traverse` byte-matched 8 of 9 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/json-schema-traverse/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/acorn-dynamic-import` byte-matched 7 of 8 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/acorn-dynamic-import/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/xtend` byte-matched 7 of 8 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/xtend/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/wasm-edit` byte-matched 6 of 7 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/wasm-edit/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/assert` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/assert/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/concat-map` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/concat-map/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/fsevents/node_modules/concat-map` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/fsevents/node_modules/concat-map/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/fsevents/node_modules/isarray` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/fsevents/node_modules/isarray/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/isarray` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/isarray/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/isexe` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/isexe/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/pump` byte-matched 6 of 7 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/pump/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/helper-buffer` byte-matched 5 of 6 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/helper-buffer/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/helper-module-context` byte-matched 5 of 6 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/helper-module-context/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/helper-wasm-bytecode` byte-matched 5 of 6 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/helper-wasm-bytecode/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/wasm-gen` byte-matched 5 of 6 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/wasm-gen/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/wasm-opt` byte-matched 5 of 6 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/wasm-opt/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@xtuc/ieee754` byte-matched 5 of 6 file(s) against @xtuc/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@xtuc/ieee754/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @xtuc/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/core-util-is` byte-matched 5 of 6 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/core-util-is/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/fsevents/node_modules/core-util-is` byte-matched 5 of 6 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/fsevents/node_modules/core-util-is/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/js-sha1` byte-matched 5 of 6 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/js-sha1/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/stream-browserify` byte-matched 5 of 6 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/stream-browserify/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/floating-point-hex-parser` byte-matched 4 of 5 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/floating-point-hex-parser/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/ieee754` byte-matched 4 of 5 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/ieee754/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/@webassemblyjs/wast-printer` byte-matched 4 of 5 file(s) against @webassemblyjs/[email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/@webassemblyjs/wast-printer/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against @webassemblyjs/[email protected] before greenflagging.

The directory `docs/import-demo/node_modules/fsevents/node_modules/string_decoder` byte-matched 4 of 5 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/fsevents/node_modules/string_decoder/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/is-buffer` byte-matched 4 of 5 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/is-buffer/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

The directory `docs/import-demo/node_modules/string_decoder` byte-matched 4 of 5 file(s) against [email protected] — a version that passed review and that we hold in storage — which identifies it as a vendored copy of that package. But 1 file(s) inside it differ from that package's bytes at the same path: docs/import-demo/node_modules/string_decoder/package.json. A vendored library that is a faithful copy except for a handful of altered files is a well-worn supply-chain shape — the surrounding real code lends the tree legitimacy while the altered files carry the payload. These files are NOT exempt from any authorship heuristic; diff them against [email protected] before greenflagging.

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

eval() can execute arbitrary code — common in supply-chain attacks but also used by legitimate parsers and template engines. Verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L25 23 | * @license MIT 24 | */ > 25 | !function(){"use strict";var root="object"==typeof window?window:{},NODE_JS=!root.JS_SHA1_NO_NODE_JS&&"object"==typeof p 26 | /*! 27 | * Vue.js v2.6.10

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/tencentyun/vod-js-sdk-v6/blob/d3884f4192fae881a9538ce12459834a1952447b/docs/import-demo/bundle.js#L30 28 | * (c) 2014-2019 Evan You 29 | * Released under the MIT License. > 30 | */var r;r=function(){"use strict";var e=Object.freeze({});function r(e){return null==e}function o(e){return null!=e}fun 31 | //# sourceMappingURL=bundle.js.map

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Modified file contains 3 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.