hotkeys-js
A simple micro-library for defining and dispatching keyboard shortcuts. It has no dependencies.
14
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
wcjiang
Keywords
hotkeyhotkeyshotkeys-jshotkeysjskeykeyskeyboardshortcutskeypress
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:doc/assets/index-Ch2biG9H.js | AI (source-diff): Vite-bundled documentation asset (React+markdown); not part of runtime. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:doc/lcov-report/prettify.js | AI (source-diff): Google code-prettify from Istanbul lcov HTML report; standard coverage tooling artifact. | ai | |
| source-diff | net-exec-file:doc/assets/index-D-JlFIiP.js | AI (source-diff): fetch() is modulepreload polyfill in Vite bundle; doc asset, not runtime code. No malicious network/exec pattern. | ai | |
| source-diff | obfuscated-file:doc/assets/index-D-JlFIiP.js | AI (source-diff): Vite-bundled React documentation site asset under doc/; not a runtime file. Standard build output pattern. | ai | |
| source-diff | obfuscated-file:doc/assets/index-CEa7LRUR.js | AI (source-diff): Vite-bundled documentation site asset under doc/; contains React runtime and standard browser code. Not referenced by any package entry point. | ai | |
| source-diff | net-exec-file:doc/assets/index-CEa7LRUR.js | AI (source-diff): Browser-side modulepreload fetch in documentation bundle. Standard Vite output pattern, not server-side network/exec. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from manual publishing (wcjiang) to GitHub Actions CI/CD, confirmed by SLSA provenance attestation. Same maintainer. | ai | |
| source-diff | obfuscated-file:doc/static/js/138.39666e62.chunk.js | AI (source-diff): Webpack-bundled documentation chunk (Gherkin grammar); benign minified build output. | ai | |
| source-diff | obfuscated-file:doc/static/js/0.81be4b42.chunk.js | AI (source-diff): Webpack-bundled Prism.js syntax highlighting chunks in doc/ folder; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:doc/static/js/1.f35e8e9c.chunk.js | AI (source-diff): Webpack-bundled Prism.js syntax highlighting chunks in doc/ folder; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:doc/static/js/120.9d7092f1.chunk.js | AI (source-diff): Webpack-bundled documentation chunk (Prism language grammars); benign minified build output. | ai | |
| source-diff | obfuscated-file:doc/static/js/121.79783e7b.chunk.js | AI (source-diff): Webpack-bundled documentation chunk (Prism language grammars); benign minified build output. | ai | |
| source-diff | obfuscated-file:doc/static/js/139.892e850c.chunk.js | AI (source-diff): Webpack-bundled documentation chunk (Gherkin grammar); benign minified build output. | ai | |
| source-diff | obfuscated-file:doc/static/js/14.93fca78b.chunk.js | AI (source-diff): Webpack-bundled documentation chunk (Apache config grammar); benign minified build output. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are all doc/ build artifacts (webpack chunks, source maps); package ships built documentation site. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is from bundled documentation site under doc/; no change to library runtime code. | ai | |
| source-diff | obfuscated-file:doc/assets/markdown-vendor.js | AI (source-diff): Vite-bundled vendor chunk for markdown rendering (unified/remark). Documentation asset, not runtime code. | ai | |
| source-diff | obfuscated-file:doc/assets/uiw-components.js | AI (source-diff): Vite-bundled React + uiw components vendor chunk for documentation site. Not runtime code. | ai | |
| source-diff | obfuscated-file:doc/assets/theme-vendor.js | AI (source-diff): Bundled @wcj/dark-mode component (same author) for docs site dark mode toggle. | ai | |
| source-diff | obfuscated-file:doc/assets/react-vendor.js | AI (source-diff): Vite-bundled React DOM vendor chunk for documentation site. Not runtime library code. | ai | |
| source-diff | obfuscated-file:doc/assets/index-BzXXzRfA.js | AI (source-diff): Vite-bundled documentation site asset containing React scheduler and modulepreload polyfill. Not runtime library code. | ai | |
| source-diff | net-exec-file:doc/assets/markdown-vendor.js | AI (source-diff): False positive: fetch for modulepreload + standard JS patterns in bundled markdown lib. Doc asset only. | ai | |
| source-diff | obfuscated-file:doc/static/js/main.c7223b07.chunk.js | AI (source-diff): Webpack-bundled documentation site asset under doc/static/js/; standard build output from kkt, not obfuscated malicious code. Pattern is stable for this package. | ai | |
| source-diff | obfuscated-file:doc/assets/index-BDFq7g16.js | AI (source-diff): Bundled Vite documentation site asset under doc/assets/; standard minified React app, not consumed as library code. Stable for this package. | ai |