← Home

amd-utils

npm Repository Homepage

Utility methods written in the AMD format

9
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

millermedeiros

Keywords

utilitiesfunctionalamd

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is in doc/html assets (documentation JS), not in the runtime library code consumed by dependents. ai
provenance no-provenance AI (provenance): Package is 14+ years old, predates Sigstore provenance. No realistic supply-chain risk from missing attestation on this established package. ai
source-diff large-new-source-files AI (source-diff): The 175 files are the package's normal AMD utility modules and documentation assets, not injected code. Stable characteristic of this package across versions. ai
semgrep semgrep:eval-usage AI (semgrep): Fires on doc/html assets — SyntaxHighlighter documentation library only, not part of the package's runtime code. ai
semgrep semgrep:new-function-constructor AI (semgrep): Fires on jQuery 1.7 bundled in documentation assets — legitimate minified jQuery, not runtime package code. ai
install-scripts install-script:install AI (install-scripts): Install script runs a local build conversion script for AMD module format — consistent with the package's documented purpose, no remote code execution. ai
semgrep semgrep:obfuscation-packer AI (semgrep): Fires on doc/html assets — SyntaxHighlighter library bundled in documentation, not runtime code. Dean Edwards packer is a known minifier pattern. ai
source-diff obfuscated-file:coverage/lcov-report/prettify.js AI (source-diff): This is Google's prettify.js syntax highlighter, minified and bundled automatically by Istanbul into lcov HTML coverage reports. Not malicious; stable false positive for this package. ai

Versions (showing 9 of 9)

Version Deps Published
0.10.0 0 / 7
0.9.0 0 / 4
0.8.1 0 / 4
0.8.0 2 / 3
0.6.0 2 / 2
0.5.1 2 / 2
0.5.0 2 / 2
0.4.0 2 / 2
0.0.1 0 / 2

v0.10.0

2 findings
HIGH New obfuscated file: coverage/lcov-report/prettify.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

5 findings
HIGH Package has 'install' script install-scripts

Script: node ./_build/convert.js

HIGH obfuscation-packer: doc/html/assets_/js/lib/syntax-highlighter/shAutoloader.js:17 semgrep

JavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected 15 | * Dual licensed under the MIT and GPL licenses. 16 | */ > 17 | eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin

HIGH obfuscation-packer: doc/html/assets_/js/lib/syntax-highlighter/shCore.js:17 semgrep

JavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected 15 | * Dual licensed under the MIT and GPL licenses. 16 | */ > 17 | eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin

HIGH obfuscation-packer: doc/html/assets_/js/lib/syntax-highlighter/shLegacy.js:17 semgrep

JavaScript packer pattern (eval(function(p,a,c,k,e,...))) detected 15 | * Dual licensed under the MIT and GPL licenses. 16 | */ > 17 | eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toStrin

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.