← Home

y-leveldb

npm Repository Homepage

LevelDb database adapter for Yjs

7
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

dmonad

Keywords

YjsCRDTofflineshared editingcollaborationconcurrency

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/test.js AI (source-diff): dist/test.js is a rollup-bundled test artifact from the Yjs ecosystem build process. Sample shows readable JSDoc-annotated code, not obfuscation. Stable false positive for this package. ai
source-diff source-size-tripled AI (source-diff): Size increase is due to rollup bundling lib0 and other deps into dist output — a legitimate build artifact change, not injected payload. ai
dependencies unvetted-dep:lib0 AI (dependencies): lib0 is authored by dmonad (same publisher as y-leveldb) and is a core utility library in the Yjs ecosystem; not a risk for this package. ai
source-diff encoded-string-file:dist/test.js AI (source-diff): The encoded string is a base64-encoded Nyan Cat GIF image (variable named nyanCatImage) used for test suite visual output. Not a malicious payload; stable for this package. ai
publish-pattern dormant-publish AI (publish-pattern): Publisher dmonad is the original Yjs ecosystem author with 28 approved packages. Dormant periods are normal for established OSS maintainers returning to update libraries. ai

Versions (showing 7 of 7)

Version Deps Published
0.2.0 3 / 15
0.1.2 2 / 14
0.1.1 2 / 14
0.1.0 2 / 14
0.0.3 5 / 11
0.0.2 5 / 11
0.0.1 3 / 11

v0.2.0

2 findings
HIGH Long encoded string in modified file: dist/test.js source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

2 findings
HIGH New obfuscated file: dist/test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

2 findings
HIGH New obfuscated file: dist/test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.