@crmy/server — Greenflagged

CRMy server — Express + PostgreSQL + MCP endpoint

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

codycharris

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:public/assets/index-CdPJsOEj.js	AI (source-diff): Standard Vite/React production bundle; minification is expected for a bundled web UI asset.	ai	2026/06/13
source-diff	obfuscated-file:public/assets/index-BhdR5p_0.js	AI (source-diff): Standard Vite/React production bundle served as static UI asset; minification is expected for this package.	ai	2026/06/13
source-diff	obfuscated-file:public/assets/index-Bxk1RcTF.js	AI (source-diff): Standard Vite/React minified bundle; sample confirms React production build output, not malicious obfuscation.	ai	2026/06/13
source-diff	obfuscated-file:public/assets/index-D1Lhmm24.js	AI (source-diff): Standard Vite/React production bundle served as static UI assets; minification is expected and benign.	ai	2026/06/11
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get usage is inside React internals within the bundled frontend; not obfuscation.	ai	2026/06/11
source-diff	source-size-tripled	AI (source-diff): Size increase explained by addition of bundled frontend assets (React SPA build output).	ai	2026/06/10
source-diff	obfuscated-file:public/assets/index-CskfWp8E.js	AI (source-diff): Standard Vite/React production bundle; React license header and modulepreload patterns confirm legitimate minified frontend asset.	ai	2026/06/10
phantom-deps	phantom-dep:@crmy/web	AI (phantom-deps): Same-org web frontend served by Express; declared dep not directly imported is expected.	ai	2026/06/10
phantom-deps	phantom-dep:nodemailer	AI (phantom-deps): nodemailer used at runtime via dynamic config; stable false positive for this server package.	ai	2026/06/10
phantom-deps	phantom-dep:node-pg-migrate	AI (phantom-deps): Migration CLI tool invoked via scripts, not imported; stable false positive.	ai	2026/06/10
source-diff	obfuscated-file:public/assets/ContactDrawer-CFXKV2x4.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Contacts-yNFhQutT.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Context-BVQiQD9q.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/CrmWidgets-sMNLaPuG.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Dashboard-CvjByMY1.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/EmailDraftDrawer-Dyow1HEl.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/EmailDrawer-BnCT3LRh.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Emails-BP-9TS5i.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/en-US-ZtQonj2f.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	large-new-source-files	AI (source-diff): Package bundles a React frontend; large number of Vite-generated asset files is expected for this package.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/date-picker-DRo4EldO.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/AccountDrawer-Dj5RN41t.js	AI (source-diff): Standard Vite minified React bundle output; readable JSX logic visible in sample, not obfuscated malware.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Accounts-VnMLn5HS.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Activities-DsY5nOGv.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/ActivityDrawer-pFFRRITK.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Agent-Cc67gFfS.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/AgentActivity-BxEevx9y.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/AssignmentDrawer--eGGH_x5.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/AuditLog-C_BrGOFB.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
source-diff	obfuscated-file:public/assets/Automations-CoMKyXFZ.js	AI (source-diff): Standard Vite minified React bundle output.	ai	2026/06/09
typosquat	typosquat.levenshtein:semver	AI (typosquat): @crmy/server is a scoped CRM server package; Levenshtein match to 'semver' is coincidental, not impersonation.	ai	2026/04/28

Versions (showing 17 of 17)

Version	Deps	Published
0.8.9	19 / 5	2026-06-08
0.8.8	19 / 5	2026-06-08
0.8.4	17 / 4	2026-05-30
0.7.2	17 / 4	2026-05-09
0.7.1	17 / 4	2026-05-06
0.7.0	17 / 4	2026-04-26
0.6.1	17 / 4	2026-04-10
0.6.0	9 / 4	2026-03-27
0.5.10	8 / 4	2026-03-18
0.5.9	8 / 4	2026-03-18
0.5.8	8 / 4	2026-03-18
0.5.7	9 / 4	2026-03-18
0.5.6	8 / 4	2026-03-18
0.5.5	8 / 4	2026-03-18
0.5.3	8 / 4	2026-03-17
0.5.2	8 / 4	2026-03-17
0.5.1	8 / 4	2026-03-17

v0.8.9

36 findings

HIGH New obfuscated file: public/assets/AccountDrawer-IOmIhsxI.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Accounts-CayUByl3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Activities-E5U-6TZc.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/ActivityDrawer-DjOb5hV0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Agent-NkpSgYr7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/AgentActivity-4atHeF8j.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/AssignmentDrawer-CQ-mNlOu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/AuditLog-3luUIymN.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Automations-BzwDu6-0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/ContactDrawer-wdR9aERt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Contacts-2OPKPELN.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Context-BLjTM0IJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/CrmWidgets-CkCUysjt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Dashboard-D1MXkrOW.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/date-picker-BSNHDU9X.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/EmailDraftDrawer-CRapE2yu.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/EmailDrawer-Byo7G--g.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Emails-Da2YDZKT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/entity-combobox-Dzi-nllU.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/GraphSidebar-Cx9g_RKC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Inbox-BHpab9mB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/index-BaDvoEcp.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/ListToolbar-DG39pFpY.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/MemoryGraph-8J0n3qiL.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/ObjectActionBar-BJgRjPe_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Operations-DKgLLjjy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Opportunities-Di16TZ7z.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/OpportunityDrawer-B3D6UaiJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/QuickAddDrawer-_aYaJEPy.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/SearchResults-YH_kjwGC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/select-D_p4w7CS.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/SequenceEditor-BOTNFCUW.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Sequences-Ctp7HQAs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Settings-BfMvDoYo.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/UseCaseDrawer-BkGtwD8W.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.8

20 findings

HIGH New obfuscated file: public/assets/AccountDrawer-Dj5RN41t.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Accounts-VnMLn5HS.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Activities-DsY5nOGv.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/ActivityDrawer-pFFRRITK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Agent-Cc67gFfS.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/AgentActivity-BxEevx9y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/AssignmentDrawer--eGGH_x5.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/AuditLog-C_BrGOFB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Automations-CoMKyXFZ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/ContactDrawer-CFXKV2x4.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Contacts-yNFhQutT.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Context-BVQiQD9q.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/CrmWidgets-sMNLaPuG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Dashboard-CvjByMY1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/date-picker-DRo4EldO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/EmailDraftDrawer-Dyow1HEl.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/EmailDrawer-BnCT3LRh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/Emails-BP-9TS5i.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: public/assets/en-US-ZtQonj2f.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.4

2 findings

HIGH New obfuscated file: public/assets/index-CdPJsOEj.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

2 findings

HIGH New obfuscated file: public/assets/index-BhdR5p_0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

2 findings

HIGH New obfuscated file: public/assets/index-Bxk1RcTF.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'semver' typosquat

Package name '@crmy/server' is 1 edit(s) away from popular package 'semver'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.0

2 findings

HIGH New obfuscated file: public/assets/index-D1Lhmm24.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.10

2 findings

HIGH New obfuscated file: public/assets/index-CskfWp8E.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.9

2 findings

HIGH New obfuscated file: public/assets/index-CskfWp8E.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.8

2 findings

HIGH New obfuscated file: public/assets/index-CskfWp8E.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.