← Home

@igo2/utils

npm Repository Homepage
12
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

mbarbeaupelordalexandre.caron12

Keywords

igo

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:esm2022/lib/watcher.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/files/excel.mjs AI (source-diff): Readable compiled ESM; long-line trigger is inline sourcemap base64 data URI. ai
source-diff obfuscated-file:esm2022/lib/files/file.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/object-utils.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/string-utils.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/tree/tree.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/base64.mjs AI (source-diff): Long lines are inline sourcemap base64 data URIs appended by Angular build tooling, not obfuscated code. ai
source-diff obfuscated-file:esm2022/lib/change.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/clipboard.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
source-diff obfuscated-file:esm2022/lib/compression/compression.utils.mjs AI (source-diff): Readable compiled ESM; long-line trigger is sourcemap comment. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI/CD publisher with SLSA attestation; legitimate automation migration for this established package. ai
source-diff source-size-dropped AI (source-diff): Size drop explained by removal of bowser and xlsx runtime deps; consistent with the version diff. ai
dependencies unvetted-dep:xlsx AI (dependencies): SheetJS CDN URL is the canonical distribution channel for this version; consistent with igo2-lib's established usage pattern. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): tslib is a known Angular/TypeScript implicit runtime dependency; phantom-dep false positive. ai
npm-metadata url-dep:xlsx AI (npm-metadata): SheetJS distributes via their own CDN post-relicense; this is the documented install method for xlsx >=0.20.x. ai

Versions (showing 12 of 12)

Version Deps Published
20.2.0 1 / 0
20.1.1 1 / 0
20.1.0 1 / 0
20.0.1 1 / 0
18.1.4 3 / 0
18.0.7 3 / 0
18.0.6 3 / 0
18.0.5 3 / 0
18.0.4 3 / 0
18.0.3 3 / 0
18.0.2 3 / 0
18.0.1 3 / 0

v20.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v20.1.1

2 findings
HIGH Publisher changed: alexandre.caron12 → GitHub Actions (on 2026-05-19) provenance

This version was published by a different npm account than previous versions on 2026-05-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v20.1.0

2 findings
HIGH Publisher changed: alexandre.caron12 → GitHub Actions (on 2026-05-05) provenance

This version was published by a different npm account than previous versions on 2026-05-05. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v20.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.1.4

11 findings
HIGH New obfuscated file: esm2022/lib/base64.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/change.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/clipboard.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/compression/compression.utils.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/files/excel.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/files/file.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/object-utils.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/string-utils.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/tree/tree.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: esm2022/lib/watcher.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.