di
Dependency Injection for Node.js. Heavily inspired by AngularJS.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): eval() usage is from es6-module-loader's __scopedEval, a documented mechanism for ES6 module scope execution; not malicious. | ai | |
| source-diff | net-exec-file:compiled/angular-loader/es6-module-loader.js | AI (source-diff): Same es6-module-loader polyfill in compiled/ directory; same rationale as example/ version. | ai | |
| source-diff | obfuscated-file:compiled/angular-loader/traceur.js | AI (source-diff): Same traceur.js transpiler in compiled/ directory; minification is expected. | ai | |
| source-diff | net-exec-file:compiled/angular-loader/traceur.js | AI (source-diff): Same traceur.js transpiler in compiled/ directory; eval/network patterns are part of documented transpiler functionality. | ai | |
| source-diff | net-exec-file:compiled/example/angular-loader/es6-module-loader.js | AI (source-diff): Same es6-module-loader polyfill in compiled/example/ directory; same rationale as other instances. | ai | |
| source-diff | obfuscated-file:example/angular-loader/es6-module-loader.js | AI (source-diff): es6-module-loader v0.4.0 is a well-known open-source ES6 module loader polyfill; minification is expected for this bundled example asset. | ai | |
| source-diff | net-exec-file:example/angular-loader/es6-module-loader.js | AI (source-diff): The eval() in es6-module-loader is the documented __scopedEval mechanism for ES6 module loading, not malware. Network calls are part of the module loader's fetch/locate API. | ai | |
| source-diff | obfuscated-file:example/angular-loader/traceur.js | AI (source-diff): traceur.js is Google's ES6-to-ES5 transpiler, a well-known legitimate tool; minification is expected for this bundled example asset. | ai | |
| source-diff | net-exec-file:example/angular-loader/traceur.js | AI (source-diff): traceur.js is a legitimate transpiler runtime; any eval/network patterns are part of its documented transpilation and module loading functionality. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): 'di' is a well-established abbreviation for dependency injection, not a typosquat of 'qs'. Package is 13+ years old by a reputable publisher. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): 'di' is a well-established abbreviation for dependency injection, not a typosquat of 'joi'. Package is 13+ years old by a reputable publisher. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Version 0.0.0 reflects early npm ecosystem conventions from 2012, not malicious intent. Package has 17 versions and a long legitimate history. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): 'di' is a well-established abbreviation for dependency injection, not a typosquat of 'pg'. Package is 13+ years old by a reputable publisher. | ai |
v1.9.0
9 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.