@nocobase/client-v2 — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chenosjiannlu

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get() in useCodeRunner.ts is a proxy trap for sandboxed code execution, not evasion.	ai	2026/06/11
source-diff	net-exec-file:es/index.mjs	AI (source-diff): Network calls and dynamic execution in a UI bundle are expected; no dropper pattern present.	ai	2026/06/11
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): Raw IP appears only in a test fixture for apiClient baseURL, not production code.	ai	2026/06/11
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() is in a test file for a code-runner/evaluator feature; input is user-controlled by design.	ai	2026/06/11
source-diff	obfuscated-file:es/index.mjs	AI (source-diff): es/index.mjs is a standard rspack bundle with license header and well-known external imports; not obfuscation.	ai	2026/06/11
bogus-package	bogus-package	AI (bogus-package): Part of the @nocobase monorepo; sparse metadata (no description/repo/keywords) is typical for monorepo-published packages, not an indicator of spam or malice.	ai	2026/04/27
phantom-deps	phantom-dep:@nocobase/shared	AI (phantom-deps): Same-org monorepo dependency; phantom-dep detection is unreliable for intra-monorepo packages that may be transitively or conditionally used.	ai	2026/04/27
semgrep	semgrep:eval-usage	AI (semgrep): eval() is in bundled RequireJS (req.exec), a well-known AMD loader that legitimately uses eval for module execution. This is a stable false positive for this package.	ai	2026/04/27

Versions (showing 51 of 66)

View all versions

Version	Deps	Published
2.1.4	26 / 0	2026-06-13
2.1.2	26 / 0	2026-06-11
2.1.1	26 / 0	2026-06-11
2.1.0	26 / 0	2026-06-10
2.0.62	5 / 0	2026-06-10
2.0.61	5 / 0	2026-06-03
2.0.60	5 / 0	2026-05-29
2.0.59	5 / 0	2026-05-28
2.0.58	5 / 0	2026-05-28
2.0.57	5 / 0	2026-05-25
2.0.56	5 / 0	2026-05-21
2.0.55	5 / 0	2026-05-18
2.0.54	5 / 0	2026-05-15
2.0.53	5 / 0	2026-05-14
2.0.52	5 / 0	2026-05-13
2.0.51	5 / 0	2026-05-10
2.0.50	5 / 0	2026-05-09
2.0.49	5 / 0	2026-05-06
2.0.48	5 / 0	2026-05-04
2.0.47	5 / 0	2026-05-01
2.0.46	5 / 0	2026-04-28
2.0.45	5 / 0	2026-04-27
2.0.44	5 / 0	2026-04-26
2.0.43	5 / 0	2026-04-24
2.0.42	5 / 0	2026-04-23
2.0.41	5 / 0	2026-04-22
2.0.40	5 / 0	2026-04-20
2.0.39	5 / 0	2026-04-17
2.0.38	5 / 0	2026-04-16
2.0.37	5 / 0	2026-04-14
2.0.36	5 / 0	2026-04-10
2.0.35	5 / 0	2026-04-09
2.0.34	5 / 0	2026-04-08
2.0.33	5 / 0	2026-04-08
2.0.32	5 / 0	2026-04-04
2.0.31	5 / 0	2026-04-01
2.0.30	5 / 0	2026-03-30
2.0.29	5 / 0	2026-03-29
2.0.28	5 / 0	2026-03-27
2.0.27	5 / 0	2026-03-26
2.0.26	5 / 0	2026-03-25
2.0.25	5 / 0	2026-03-23
2.0.24	5 / 0	2026-03-22
2.0.23	5 / 0	2026-03-20
2.0.22	5 / 0	2026-03-20
2.0.21	5 / 0	2026-03-20
2.0.20	5 / 0	2026-03-19
2.0.19	5 / 0	2026-03-17
2.0.18	5 / 0	2026-03-17
2.0.17	5 / 0	2026-03-14
2.0.16	5 / 0	2026-03-12

v2.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

3 findings

HIGH New obfuscated file: es/index.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: es/index.mjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.62

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.61

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.60

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.59

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.58

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.57

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.56

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.55

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.54

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.53

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.52

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.51

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.50

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.49

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.48

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.47

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.45

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.44

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.43

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.42

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.41

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.40

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.39

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.38

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.37

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.36

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.35

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.34

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.33

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.32

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.31

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.30

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.29

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.28

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.24

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.