← Home

art-template

npm Repository Homepage

JavaScript Template Engine

21
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

daughtrymomnpmpacketmaintainmember7

Keywords

template

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist/template-native.js AI (source-diff): Minified browser distribution of the template engine; new Function() is the template compilation mechanism, not a dropper. ai
source-diff net-exec-file:dist/template-native-debug.js AI (source-diff): Template engine build artifact; same false positive pattern as template-debug.js — new Function() for template compilation, URLs only in comments. ai
source-diff net-exec-file:src/src/template.js AI (source-diff): Core template engine source file; new Function() is the documented template compilation mechanism, not malicious code execution. ai
source-diff obfuscated-file:dist/template-native.js AI (source-diff): Minified via grunt-contrib-uglify as expected for a browser distribution build; not obfuscated malware. ai
source-diff net-exec-file:dist/template-debug.js AI (source-diff): Template engine build artifact; new Function() is the core template compilation mechanism, not malware. URL strings in comments trigger false network detection. ai
phantom-deps phantom-dep:is-keyword-js AI (phantom-deps): Same as js-tokens — bundled into webpack output, not directly imported in unbundled source. ai
phantom-deps phantom-dep:js-tokens AI (phantom-deps): Deps are bundled into webpack output in lib/; not directly required at runtime from node_modules. Phantom detection is a false positive for bundled packages. ai
source-diff net-exec-file:lib/template-node.js AI (source-diff): lib/template-node.js is a webpack bundle of the template engine itself. 'Network' and 'exec' signals come from webpack's module system and template compilation via new Function(), not malicious dropper behavior. ai
source-diff net-exec-file:lib/template-web.js AI (source-diff): lib/template-web.js is a minified webpack UMD bundle for browser use. Same false-positive pattern as template-node.js — no actual remote code fetching. ai
source-diff obfuscated-file:lib/template-web.js AI (source-diff): lib/template-web.js is a legitimately minified webpack bundle (UMD format) for browser distribution. Long lines are expected minification output, not obfuscation. ai
phantom-deps phantom-dep:detect-node AI (phantom-deps): Same as js-tokens — bundled into webpack output, not directly imported in unbundled source. ai
publish-pattern new-deps-added AI (publish-pattern): js-tokens is a well-known Babel ecosystem package for JS tokenization; its use in a template engine is expected and benign. ai
semgrep semgrep:new-function-constructor AI (semgrep): art-template is a template engine; new Function() is its core compilation mechanism. This is expected and documented behavior, not a security risk in this context. ai
dependencies unvetted-dep:html-minifier AI (dependencies): html-minifier is a well-known package; its use in a template engine for HTML minification is expected and benign. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require in precompile.js is an intentional API feature allowing users to specify import paths. Not arbitrary code loading. ai

Versions (showing 21 of 21)

Version Deps Published
4.13.2 8 / 11
4.12.2 9 / 11
4.12.0 9 / 11
4.8.2 9 / 11
4.7.0 8 / 11
4.5.1 8 / 11
4.4.0 8 / 11
4.3.1 7 / 9
4.1.0 3 / 9
4.0.0 3 / 9
3.1.3 0 / 6
3.1.2 2 / 6
3.1.1 2 / 6
3.1.0 0 / 6
3.0.3 0 / 6
3.0.2 0 / 6
3.0.1 0 / 6
3.0.0 0 / 5
2.0.4 0 / 0
2.0.3 0 / 0
2.0.2 0 / 0

v4.13.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.12.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.8.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.0

4 findings
HIGH New file with network + code execution: lib/template-node.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: lib/template-web.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: lib/template-web.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v3.0.0

6 findings
HIGH New file with network + code execution: dist/template-debug.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/template-native-debug.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/template-native.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/template-native.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: src/src/template.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.