bson
A bson parser for node.js and the browser
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:browser_build/bson.js | AI (source-diff): browser_build/bson.js is a standard webpack UMD bundle for browser compatibility. The 'network + code execution' detection is a false positive on webpack's __webpack_require__ module loader pattern. | ai | |
| source-diff | net-exec-file:src/utils/global.ts | AI (source-diff): False positive: TypeScript source for the same cross-environment global detection utility. No network calls; Function() usage is a documented globalThis polyfill pattern. | ai | |
| source-diff | net-exec-file:lib/utils/global.js | AI (source-diff): False positive: file contains a standard cross-environment global detection utility using Function('return this')() — a documented pattern from core-js with no actual network calls or malicious behavior. | ai | |
| source-diff | obfuscated-file:vendor/text-encoding/lib/encoding-indexes.js | AI (source-diff): This file is the standard text-encoding polyfill's character index table (large arrays of code points), vendored from the well-known open-source [email protected] library. Not obfuscated malicious code. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size tripling explained by addition of multiple browser bundle distribution files (ESM, UMD, bundle) — legitimate build artifact expansion. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Size increase is due to added browser bundle dist files (rollup output) and TypeScript sources — standard for bson's build process. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): The 'buffer' package is a well-known Node.js Buffer polyfill for browsers, added to support new browser bundle distribution. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Previous maintainers (christkv, daprahamian, octave) removed as part of MongoDB team transition; consistent with legitimate org change. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): nbbeeken is a MongoDB employee with established npm history (2017); legitimate team transition for mongodb/js-bson. | ai | |
| source-diff | net-exec-file:dist/bson.bundle.js | AI (source-diff): Standard rollup bundle output for bson. No malicious patterns. | ai | |
| source-diff | net-exec-file:lib/map.js | AI (source-diff): Map polyfill using Function('return this')() for cross-environment global detection — well-known safe pattern. | ai | |
| source-diff | net-exec-file:src/map.ts | AI (source-diff): TypeScript source for Map polyfill. Same safe cross-environment global detection pattern. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used in isolateEval() for BSON JavaScript code type deserialization — a documented BSON feature, not malicious. | ai | |
| source-diff | net-exec-file:dist/bson.browser.esm.js | AI (source-diff): Standard rollup-bundled browser ESM output with TypeScript helpers and BSON logic. No actual network calls or malicious execution. | ai | |
| source-diff | net-exec-file:dist/bson.browser.umd.js | AI (source-diff): Standard rollup UMD bundle output. No malicious network or execution patterns. | ai | |
| source-diff | net-exec-file:dist/bson.esm.js | AI (source-diff): Standard rollup ESM bundle. Imports 'buffer' polyfill for browser compatibility — legitimate. | ai | |
| source-diff | net-exec-file:dist/bson.js | AI (source-diff): dist/bson.js is a standard UMD browser bundle built by rollup (prepublishOnly). The sample shows UMD boilerplate and a Map polyfill — no actual network calls or malicious execution. False positive for this build artifact. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in BSON deserializer reconstructs JavaScript function objects stored as BSON Code type — a documented BSON feature, not a supply-chain risk. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from mbroadst to nbbeeken is a documented MongoDB team transition; nbbeeken has established history. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is core BSON binary type serialization — expected and legitimate. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding used for ObjectId construction — core BSON functionality. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Inflated semver and mass-production signals are false positives: this is the official MongoDB BSON library migrating to a new publisher account with SLSA provenance attestation. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in etc/prepare.js build script only, not runtime code. | ai |
Versions (showing 51 of 72)
| Version | Deps | Published |
|---|---|---|
| 7.2.0 | 0 / 34 | |
| 7.1.1 | 0 / 34 | |
| 7.1.0 | 0 / 34 | |
| 7.0.0 | 0 / 34 | |
| 6.10.4 | 0 / 35 | |
| 6.10.3 | 0 / 35 | |
| 6.10.2 | 0 / 35 | |
| 6.10.1 | 0 / 35 | |
| 6.10.0 | 0 / 36 | |
| 6.9.1 | 0 / 36 | |
| 6.9.0 | 0 / 36 | |
| 6.8.1 | 0 / 36 | |
| 6.8.0 | 0 / 36 | |
| 6.7.1 | 0 / 37 | |
| 6.7.0 | 0 / 37 | |
| 6.6.1 | 0 / 37 | |
| 6.6.0 | 0 / 37 | |
| 6.5.1 | 0 / 37 | |
| 6.5.0 | 0 / 37 | |
| 6.4.1 | 0 / 37 | |
| 6.4.0 | 0 / 37 | |
| 6.3.0 | 0 / 37 | |
| 6.2.0 | 0 / 36 | |
| 6.1.0 | 0 / 36 | |
| 6.0.0 | 0 / 36 | |
| 5.5.1 | 0 / 36 | |
| 5.4.0 | 0 / 36 | |
| 5.3.0 | 0 / 36 | |
| 5.2.0 | 0 / 36 | |
| 5.1.0 | 0 / 36 | |
| 5.0.1 | 0 / 36 | |
| 5.0.0 | 0 / 35 | |
| 4.7.2 | 1 / 44 | |
| 4.7.1 | 1 / 44 | |
| 4.7.0 | 1 / 44 | |
| 4.6.5 | 1 / 43 | |
| 4.6.4 | 1 / 43 | |
| 4.6.3 | 1 / 43 | |
| 4.6.2 | 1 / 43 | |
| 4.6.1 | 1 / 43 | |
| 4.6.0 | 1 / 43 | |
| 4.5.4 | 1 / 43 | |
| 4.5.3 | 1 / 43 | |
| 4.5.2 | 1 / 41 | |
| 4.5.1 | 1 / 40 | |
| 4.5.0 | 1 / 40 | |
| 4.4.1 | 1 / 40 | |
| 4.4.0 | 1 / 40 | |
| 4.3.0 | 1 / 40 | |
| 4.2.3 | 1 / 39 | |
| 4.2.2 | 1 / 39 |
v7.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.10.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.10.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.10.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.10.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.9.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.8.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.8.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.5.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-12. This could indicate a legitimate maintainer transition or an account compromise.
v6.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.4.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-02-29. This could indicate a legitimate maintainer transition or an account compromise.
v6.3.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-02-01. This could indicate a legitimate maintainer transition or an account compromise.
v6.2.0
2 findingsThis version was published by a different npm account than previous versions on 2023-10-18. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v6.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.5.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-10-18. This could indicate a legitimate maintainer transition or an account compromise.
v5.4.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-07-05. This could indicate a legitimate maintainer transition or an account compromise.
v5.3.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-05-10. This could indicate a legitimate maintainer transition or an account compromise.
v5.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-04-04. This could indicate a legitimate maintainer transition or an account compromise.
v5.1.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-16. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-02-16. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-01-31. This could indicate a legitimate maintainer transition or an account compromise.
v4.7.2
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-01-10. This could indicate a legitimate maintainer transition or an account compromise.
v4.7.1
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2023-01-05. This could indicate a legitimate maintainer transition or an account compromise.
v4.7.0
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-08-18. This could indicate a legitimate maintainer transition or an account compromise.
v4.6.5
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-07-07. This could indicate a legitimate maintainer transition or an account compromise.
v4.6.4
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-05-19. This could indicate a legitimate maintainer transition or an account compromise.
v4.6.3
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-04-20. This could indicate a legitimate maintainer transition or an account compromise.
v4.6.2
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-03-22. This could indicate a legitimate maintainer transition or an account compromise.
v4.6.1
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-01-06. This could indicate a legitimate maintainer transition or an account compromise.
v4.6.0
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-11-23. This could indicate a legitimate maintainer transition or an account compromise.
v4.5.4
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-11-03. This could indicate a legitimate maintainer transition or an account compromise.
v4.5.3
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-10-05. This could indicate a legitimate maintainer transition or an account compromise.
v4.5.2
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-09-14. This could indicate a legitimate maintainer transition or an account compromise.
v4.5.1
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-08-24. This could indicate a legitimate maintainer transition or an account compromise.
v4.5.0
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-08-19. This could indicate a legitimate maintainer transition or an account compromise.
v4.4.1
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-07-06. This could indicate a legitimate maintainer transition or an account compromise.
v4.4.0
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-05-18. This could indicate a legitimate maintainer transition or an account compromise.
v4.3.0
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-04-06. This could indicate a legitimate maintainer transition or an account compromise.
v4.2.3
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2021-03-02. This could indicate a legitimate maintainer transition or an account compromise.
v4.2.2
8 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-12-01. This could indicate a legitimate maintainer transition or an account compromise.