dnode — Greenflagged

freestyle rpc

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

substackseethroughtrees

Keywords

rpccallbacks

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:browser/socket.io.js	AI (source-diff): Socket.IO browser client legitimately uses network transports and new Function() as an empty constructor. This is standard browser WebSocket/XHR library code, not a dropper.	ai	2026/04/24
source-diff	obfuscated-file:browser/socket.io.js	AI (source-diff): browser/socket.io.js is the canonical minified Socket.IO 0.6.2 browser bundle (LearnBoost copyright). Minification triggers the long-line heuristic; not obfuscation or malware.	ai	2026/04/24
semgrep	semgrep:child-process-import	AI (semgrep): child_process import is in an example file (examples/multiprocess/server.js), not library runtime code. No supply-chain risk.	ai	2026/04/24
source-diff	net-exec-file:examples/chat/node_modules/jquery-browserify/lib/jquery-1.6.1.js	AI (source-diff): This is the canonical jQuery 1.6.1 library bundled in an example chat app's node_modules. Network calls and eval-like patterns are standard jQuery behavior, not malware.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() appears in a browserify bundle.js — standard module system pattern in bundled JS, not a dynamic code execution risk for this package.	ai	2026/04/24
phantom-deps	phantom-dep:traverse	AI (phantom-deps): traverse is referenced in config files only, not imported at runtime; stable false positive for this package.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Package predates Sigstore provenance on npm by many years; absence of attestation is expected and not a risk signal for this package.	ai	2026/04/24
semgrep	semgrep:eval-usage	AI (semgrep): eval() in lib/web/compat.js is a JSON.parse polyfill for old browser compat — a well-known benign pattern from the early Node/browser era, not a supply-chain risk.	ai	2026/04/24

Versions (showing 51 of 74)

View all versions

Version	Deps	Published
1.2.2	3 / 1	2015-09-23
1.2.0	3 / 1	2014-01-02
1.1.0	3 / 2	2013-11-05
1.0.5	3 / 2	2013-03-01
1.0.4	3 / 2	2013-02-24
1.0.2	3 / 2	2012-11-09
1.0.1	3 / 2	2012-07-19
0.9.12	5 / 4	2012-06-13
0.9.11	5 / 4	2012-05-01
0.9.10	5 / 4	2012-04-14
0.9.9	5 / 4	2012-04-07
0.9.8	5 / 4	2012-04-07
0.9.6	6 / 3	2012-01-09
0.9.5	6 / 3	2012-01-08
0.9.4	6 / 3	2012-01-07
0.9.3	6 / 3	2011-12-17
0.9.0	5 / 3	2011-11-03
0.8.2	4 / 3	2011-08-22
0.8.1	4 / 3	2011-08-11
0.8.0	4 / 3	2011-08-11
0.7.5	5 / 1	2011-08-09
0.7.4	5 / 1	2011-07-27
0.7.3	5 / 1	2011-06-22
0.7.1	5 / 1	2011-06-09
0.7.0	5 / 1	2011-06-09
0.6.12	5 / 1	2011-05-28
0.6.11	5 / 0	2011-05-18
0.6.10	5 / 0	2011-05-12
0.6.9	5 / 0	2011-04-23
0.6.8	5 / 0	2011-04-21
0.6.7	5 / 0	2011-04-07
0.6.6	5 / 0	2011-04-02
0.6.5	5 / 0	2011-03-31
0.6.4	5 / 0	2011-03-31
0.6.3	5 / 0	2011-03-30
0.6.2	5 / 0	2011-03-28
0.6.1	5 / 0	2011-03-24
0.6.0	5 / 0	2011-03-24
0.5.9	5 / 0	2011-03-22
0.5.8	5 / 0	2011-03-19
0.5.7	5 / 0	2011-03-02
0.5.6	5 / 0	2011-02-21
0.5.5	5 / 0	2011-02-21
0.5.4	5 / 0	2011-02-16
0.5.3	5 / 0	2011-02-15
0.5.2	4 / 0	2011-01-28
0.5.1	4 / 0	2011-01-28
0.5.0	4 / 0	2011-01-26
0.4.5	4 / 0	2011-01-10
0.4.4	4 / 0	2011-01-10
0.4.3	4 / 0	2011-01-05

v1.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

2 findings

HIGH New file with network + code execution: examples/chat/node_modules/jquery-browserify/lib/jquery-1.6.1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

3 findings

HIGH New obfuscated file: browser/socket.io.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: browser/socket.io.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.