oxfmt — Greenflagged

Formatter for the JavaScript Oxidation Compiler

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

boshen

Keywords

formatterjavascriptoxcoxfmtprettiertypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/prettier-Cy-lZk4k.js	AI (source-diff): Bundled prettier core; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/markdown-Eujfu-fQ.js	AI (source-diff): Bundled prettier markdown plugin; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/flow-Cz3mJAtC.js	AI (source-diff): Bundled prettier flow plugin; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/estree-DHQPBKqf.js	AI (source-diff): Bundled prettier estree plugin; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/acorn-C-l7ouWN.js	AI (source-diff): Bundled prettier acorn plugin; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/v4-C-HWEQJm-CvgekpKf.js	AI (source-diff): Bundled dist chunk; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-B_5IaZk7.js	AI (source-diff): Bundled jiti module loader; minified upstream artifact.	ai	2026/05/30
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-B_5IaZk7.js	AI (source-diff): jiti module loader pattern; dynamic require + module resolution is its purpose.	ai	2026/05/30
source-diff	obfuscated-file:dist/v3-D-mr2VVh-BXhnMySQ.js	AI (source-diff): Bundled dist chunk; minified upstream artifact.	ai	2026/05/30
source-diff	net-exec-file:dist/v3-D-mr2VVh-BXhnMySQ.js	AI (source-diff): Bundled dist chunk with module loader patterns; not malicious.	ai	2026/05/30
source-diff	obfuscated-file:dist/typescript-lqJOqGcK.js	AI (source-diff): Bundled prettier typescript plugin; minified upstream artifact.	ai	2026/05/30
source-diff	obfuscated-file:dist/estree-BL2Xy2uB.js	AI (source-diff): Bundled minified prettier plugin; stable pattern.	ai	2026/05/30
source-diff	obfuscated-file:dist/typescript-DkgFgfZO.js	AI (source-diff): Bundled minified prettier plugin; stable pattern.	ai	2026/05/30
source-diff	obfuscated-file:dist/v3-D-mr2VVh-DBBWnwM8.js	AI (source-diff): Bundled minified plugin; stable pattern.	ai	2026/05/30
source-diff	net-exec-file:dist/v3-D-mr2VVh-DBBWnwM8.js	AI (source-diff): Bundled plugin with dynamic require; no malicious payload.	ai	2026/05/30
source-diff	obfuscated-file:dist/v4-C-HWEQJm-OZwT-Lc8.js	AI (source-diff): Bundled minified plugin; stable pattern.	ai	2026/05/30
source-diff	obfuscated-file:dist/prettier-D7Ly-aG0.js	AI (source-diff): Bundled minified prettier core; stable pattern.	ai	2026/05/30
source-diff	obfuscated-file:dist/markdown-CDTH7TpJ.js	AI (source-diff): Bundled minified prettier plugin; stable pattern.	ai	2026/05/30
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-BtDs_aWX.js	AI (source-diff): jiti runtime loader with dynamic require; no malicious payload.	ai	2026/05/30
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-BtDs_aWX.js	AI (source-diff): Bundled jiti runtime loader; expected for this package.	ai	2026/05/30
source-diff	obfuscated-file:dist/flow-Bj4lBR-Y.js	AI (source-diff): Bundled minified prettier plugin; stable pattern.	ai	2026/05/30
source-diff	obfuscated-file:dist/acorn-Cz3eAoi8.js	AI (source-diff): Bundled minified prettier plugin; stable pattern for this formatter package.	ai	2026/05/30
source-diff	obfuscated-file:dist/acorn-sBRpswSh.js	AI (source-diff): Bundled minified prettier plugin (acorn); stable pattern for this formatter package.	ai	2026/05/29
source-diff	obfuscated-file:dist/v4-C-HWEQJm-C8EWwksG.js	AI (source-diff): Bundled minified plugin chunk; stable pattern.	ai	2026/05/29
source-diff	net-exec-file:dist/v3-D-mr2VVh-CU7hQIit.js	AI (source-diff): Plugin chunk with module loading; inherent to formatter design.	ai	2026/05/29
source-diff	obfuscated-file:dist/v3-D-mr2VVh-CU7hQIit.js	AI (source-diff): Bundled minified plugin chunk; stable pattern.	ai	2026/05/29
source-diff	obfuscated-file:dist/typescript-C_eN_ThF.js	AI (source-diff): Bundled minified prettier plugin (typescript); stable pattern.	ai	2026/05/29
source-diff	obfuscated-file:dist/prettier-Cw36juP9.js	AI (source-diff): Bundled minified prettier core; stable pattern.	ai	2026/05/29
source-diff	obfuscated-file:dist/markdown-DVLNmbQg.js	AI (source-diff): Bundled minified prettier plugin (markdown); stable pattern.	ai	2026/05/29
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-C0N20Za1.js	AI (source-diff): jiti is a module loader; net+exec pattern is inherent to its design.	ai	2026/05/29
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-C0N20Za1.js	AI (source-diff): Bundled jiti module loader; expected webpack output.	ai	2026/05/29
source-diff	obfuscated-file:dist/flow-c9AjoQam.js	AI (source-diff): Bundled minified prettier plugin (flow); stable pattern.	ai	2026/05/29
source-diff	obfuscated-file:dist/estree-CzfNsl8m.js	AI (source-diff): Bundled minified prettier plugin (estree); stable pattern.	ai	2026/05/29
source-diff	net-exec-file:dist/v3-D-mr2VVh-Bw8A9MXh.js	AI (source-diff): Bundled plugin with module loading; not malicious.	ai	2026/05/12
source-diff	obfuscated-file:dist/acorn-ay2Aj6GQ.js	AI (source-diff): Bundled prettier plugin (acorn parser); minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/estree-DZBnPYMx.js	AI (source-diff): Bundled prettier estree plugin; minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/flow-ChhAFZSt.js	AI (source-diff): Bundled prettier flow plugin; minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/markdown-CCrs3bBt.js	AI (source-diff): Bundled prettier markdown plugin; minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/prettier-s1WPCGVk.js	AI (source-diff): Bundled prettier core; minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/typescript-Cgpjcksz.js	AI (source-diff): Bundled prettier typescript plugin; minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-DezGRPD7.js	AI (source-diff): Bundled jiti module loader (webpack output); expected for this package.	ai	2026/05/12
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-DezGRPD7.js	AI (source-diff): jiti module loader naturally uses require + network; not malicious.	ai	2026/05/12
source-diff	obfuscated-file:dist/v3-D-mr2VVh-Bw8A9MXh.js	AI (source-diff): Bundled plugin variant; minified upstream artifact.	ai	2026/05/12
source-diff	obfuscated-file:dist/v4-C-HWEQJm-B81QD_Ac.js	AI (source-diff): Bundled plugin variant; minified upstream artifact.	ai	2026/05/12
source-diff	net-exec-file:dist/v4-C_IPPFom-CzWZrmWL.js	AI (source-diff): Same pattern as v3 adapter — legitimate module resolution, not dropper/loader malware. False positive for this formatter package.	ai	2026/04/27
source-diff	obfuscated-file:dist/acorn-DTid_xfu.js	AI (source-diff): Bundled minified copy of prettier's acorn plugin ([email protected]). Region comment confirms provenance. Standard build artifact for a formatter tool.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree-vodXR09f.js	AI (source-diff): Bundled minified copy of prettier's estree plugin ([email protected]). Region comment confirms provenance. Standard build artifact.	ai	2026/04/27
source-diff	obfuscated-file:dist/flow-D6joRvfg.js	AI (source-diff): Bundled minified copy of prettier's flow plugin ([email protected]). Region comment confirms provenance. Standard build artifact.	ai	2026/04/27
source-diff	obfuscated-file:dist/markdown-CDEe6Nm4.js	AI (source-diff): Bundled minified copy of prettier's markdown plugin ([email protected]). Region comment confirms provenance. Standard build artifact.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-iX8V55ba.js	AI (source-diff): Bundled minified copy of prettier itself ([email protected]). Region comment confirms provenance. Expected for a formatter tool bundling prettier.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-BFhFx1UJ.js	AI (source-diff): Bundled minified copy of prettier's TypeScript plugin ([email protected]). Region comment confirms provenance. Standard build artifact.	ai	2026/04/27
source-diff	obfuscated-file:dist/v3-RIpeMkdf-CHWXIFE7.js	AI (source-diff): Bundled minified copy of prettier-plugin-tailwindcss v3 adapter. Region comment confirms provenance. Standard build artifact.	ai	2026/04/27
source-diff	net-exec-file:dist/v3-RIpeMkdf-CHWXIFE7.js	AI (source-diff): Module._resolveFilename usage is legitimate module resolution in prettier-plugin-tailwindcss. No actual network fetch + eval pattern; false positive for this formatter package.	ai	2026/04/27
source-diff	obfuscated-file:dist/v4-C_IPPFom-CzWZrmWL.js	AI (source-diff): Bundled minified copy of prettier-plugin-tailwindcss v4 adapter. Standard build artifact for this formatter tool.	ai	2026/04/27
source-diff	obfuscated-file:dist/acorn-Dg33ba6P.js	AI (source-diff): Minified bundle of prettier's acorn plugin; #region comments identify origin. Standard rolldown bundle output for a formatter tool.	ai	2026/04/27
source-diff	obfuscated-file:dist/dist-BwrMNepk.js	AI (source-diff): Minified bundle of prettier-plugin-tailwindcss and prettier plugins. Standard ESM bundle output; SLSA provenance confirms CI build.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-XwnBEa56.js	AI (source-diff): Minified bundle of prettier's typescript plugin; #region comments identify origin. Standard rolldown bundle output.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-BwD_fsw0.js	AI (source-diff): Minified bundle of prettier core; rolldown:runtime header and prettier imports confirm legitimate bundled formatter.	ai	2026/04/27
source-diff	obfuscated-file:dist/markdown-DTqaZ9x0.js	AI (source-diff): Minified bundle of prettier's markdown plugin; #region comments identify origin. Standard rolldown bundle output.	ai	2026/04/27
source-diff	obfuscated-file:dist/flow-CgDiNJJ7.js	AI (source-diff): Minified bundle of prettier's flow plugin; #region comments identify origin. Standard rolldown bundle output.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree-Dbhq_ls-.js	AI (source-diff): Minified bundle of prettier's estree plugin; #region comments identify origin. Standard rolldown bundle output.	ai	2026/04/27
source-diff	net-exec-file:dist/dist-BwrMNepk.js	AI (source-diff): createRequire used for CJS interop in ESM bundle; no actual network fetch + exec pattern. Standard prettier plugin bundling.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-Bq7RNeoo.js	AI (source-diff): Bundled copy of [email protected]/plugins/typescript.mjs — standard minified bundler output for a formatter tool, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-D94gFlK4.js	AI (source-diff): Bundled copy of [email protected] core — standard minified bundler output for a formatter tool, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/markdown-ir78_RbM.js	AI (source-diff): Bundled copy of [email protected]/plugins/markdown.mjs — standard minified bundler output for a formatter tool, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/flow-BBddPECx.js	AI (source-diff): Bundled copy of [email protected]/plugins/flow.mjs — standard minified bundler output for a formatter tool, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree-Bq_ViZ6c.js	AI (source-diff): Bundled copy of [email protected]/plugins/estree.mjs — standard minified bundler output for a formatter tool, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/acorn-Bhqm8ew7.js	AI (source-diff): Bundled copy of [email protected]/plugins/acorn.mjs — standard minified bundler output for a formatter tool, not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/v3-D-mr2VVh-Bj3_v5Qp.js	AI (source-diff): Bundled minified copy of prettier-plugin-tailwindcss v3 support code; standard build artifact.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-CK6Vmyxp.js	AI (source-diff): Bundled minified copy of prettier itself; standard build artifact from the oxc-project formatter tool.	ai	2026/04/27
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-D7Kk0pkW.js	AI (source-diff): jiti is a TypeScript/ESM runtime loader; dynamic require is its core functionality. File is a bundled dependency from prettier-plugin-tailwindcss, not dropper malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-D7Kk0pkW.js	AI (source-diff): Bundled minified copy of the 'jiti' TypeScript/ESM loader from prettier-plugin-tailwindcss; standard build artifact, not malicious obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/v4-C-HWEQJm-D29N-mp3.js	AI (source-diff): Bundled minified copy of prettier-plugin-tailwindcss v4 support code; standard build artifact.	ai	2026/04/27
source-diff	net-exec-file:dist/v3-D-mr2VVh-Bj3_v5Qp.js	AI (source-diff): Bundled prettier-plugin-tailwindcss v3 code using jiti for module resolution; dynamic require is expected behavior for this plugin.	ai	2026/04/27
source-diff	obfuscated-file:dist/dist--xku3Vyh.js	AI (source-diff): Main bundle aggregating prettier plugins; source headers confirm legitimate bundled dependencies. Standard rolldown output for oxfmt CLI.	ai	2026/04/27
source-diff	obfuscated-file:dist/flow-upegUFFJ.js	AI (source-diff): Minified bundle of [email protected] flow plugin; source attribution in file headers confirms legitimate origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/markdown-XDdiHWR8.js	AI (source-diff): Minified bundle of [email protected] markdown plugin; source attribution in file headers confirms legitimate origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree-BHX6cYnM.js	AI (source-diff): Minified bundle of [email protected] estree plugin; source attribution in file headers confirms legitimate origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/acorn-1eXwhSm3.js	AI (source-diff): Minified bundle of [email protected] acorn plugin; source attribution in file headers confirms legitimate origin. Standard rolldown output for oxfmt CLI.	ai	2026/04/27
source-diff	net-exec-file:dist/dist--xku3Vyh.js	AI (source-diff): Network/exec pattern is createRequire and dynamic module resolution from bundled prettier source — standard formatter plugin loading, not malware.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-CYBlFpU0.js	AI (source-diff): Minified bundle of [email protected] typescript plugin; source attribution in file headers confirms legitimate origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-BvPMcj5n.js	AI (source-diff): Minified bundle of [email protected] core; source attribution in file headers confirms legitimate origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/flow-wgnoyyH6.js	AI (source-diff): Bundled minified copy of [email protected] flow plugin; standard rolldown output for a formatter tool. Not malicious.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-DcSkdikT.js	AI (source-diff): Bundled minified copy of [email protected] typescript plugin; standard rolldown output for a formatter tool. Not malicious.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-BAX-9y1Y.js	AI (source-diff): Bundled minified copy of [email protected] core; standard rolldown output for a formatter tool. Not malicious.	ai	2026/04/27
source-diff	obfuscated-file:dist/markdown-gTBUizsY.js	AI (source-diff): Bundled minified copy of [email protected] markdown plugin; standard rolldown output for a formatter tool. Not malicious.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree--Z9-_PI0.js	AI (source-diff): Bundled minified copy of [email protected] estree plugin; standard rolldown output for a formatter tool. Not malicious.	ai	2026/04/27
source-diff	obfuscated-file:dist/acorn-Dyod6zSw.js	AI (source-diff): Bundled minified copy of [email protected] acorn plugin; standard rolldown output for a formatter tool. Not malicious.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-D6xJygmA.js	AI (source-diff): Minified bundle of prettier's TypeScript plugin ([email protected]). Standard build output, not obfuscated malware. SLSA provenance confirms legitimate CI build.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-B2Z8f9vI.js	AI (source-diff): Minified bundle of [email protected] core (rolldown build). Standard build output with clear #region comments. SLSA provenance confirms legitimate CI build.	ai	2026/04/27
source-diff	obfuscated-file:dist/markdown-3iPDXd0m.js	AI (source-diff): Minified bundle of prettier's markdown plugin ([email protected]). Standard build output, not obfuscated malware. SLSA provenance confirms legitimate CI build.	ai	2026/04/27
source-diff	obfuscated-file:dist/flow-B--ySPN_.js	AI (source-diff): Minified bundle of prettier's flow plugin ([email protected]). Standard build output, not obfuscated malware. SLSA provenance confirms legitimate CI build.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree-DbXw6VOE.js	AI (source-diff): Minified bundle of prettier's estree plugin ([email protected]). Standard build output, not obfuscated malware. SLSA provenance confirms legitimate CI build.	ai	2026/04/27
source-diff	obfuscated-file:dist/acorn-Cdy8_MIV.js	AI (source-diff): Minified bundle of prettier's acorn plugin ([email protected]). Standard build output, not obfuscated malware. SLSA provenance confirms legitimate CI build.	ai	2026/04/27
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-CnTrJOrf.js	AI (source-diff): jiti is a TypeScript/ESM module loader; network+exec pattern is its core functionality (module resolution), not malware. SLSA provenance confirms CI/CD origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-CnTrJOrf.js	AI (source-diff): Bundled copy of the 'jiti' npm package (mlly/jiti runtime). Minified output from legitimate bundler; source origin clearly annotated in file comments.	ai	2026/04/27
source-diff	obfuscated-file:dist/v4-C-HWEQJm-CbHL6UrB.js	AI (source-diff): Bundled copy of prettier-plugin-tailwindcss v4 adapter. Minified output from legitimate bundler; source origin annotated in file comments.	ai	2026/04/27
source-diff	net-exec-file:dist/v3-D-mr2VVh-CisVsFM0.js	AI (source-diff): prettier-plugin-tailwindcss uses jiti for module resolution; network+exec pattern is expected behavior, not malware. SLSA provenance confirms CI/CD origin.	ai	2026/04/27
source-diff	obfuscated-file:dist/v3-D-mr2VVh-CisVsFM0.js	AI (source-diff): Bundled copy of prettier-plugin-tailwindcss v3 adapter. Minified output from legitimate bundler; source origin annotated in file comments.	ai	2026/04/27
source-diff	obfuscated-file:dist/typescript-G7g7T3yt.js	AI (source-diff): Bundled copy of prettier's TypeScript plugin. Minified output from legitimate bundler; source origin annotated in file comments.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-Dwwk1Fyx.js	AI (source-diff): Bundled copy of [email protected]. Minified output is expected for this well-known formatter library bundled into oxfmt's dist.	ai	2026/04/27
source-diff	obfuscated-file:dist/prettier-DpEoE-3g.js	AI (source-diff): This file is a bundled/minified copy of [email protected], a well-known open-source formatter. Long lines are standard build output for oxfmt, a formatter tool that wraps prettier. Not obfuscation.	ai	2026/04/27
source-diff	obfuscated-file:dist/estree-CvnLDdmw.js	AI (source-diff): Minified bundle of [email protected] estree plugin; header comment confirms origin. Standard build artifact.	ai	2026/04/23
source-diff	large-new-source-files	AI (source-diff): Large number of new files reflects addition of prettier plugin support (Tailwind, Flow, TS, etc.). Expected for this formatter's feature expansion.	ai	2026/04/23
source-diff	obfuscated-file:dist/v4-C-HWEQJm-olIGVWd7.js	AI (source-diff): Minified bundle of Tailwind CSS v4 plugin for prettier-plugin-tailwindcss. Standard build artifact.	ai	2026/04/23
source-diff	net-exec-file:dist/v3-D-mr2VVh-DA8uo048.js	AI (source-diff): Tailwind CSS v3 bundled plugin; network+exec pattern expected for CSS processing. SLSA provenance confirms legitimate build.	ai	2026/04/23
source-diff	obfuscated-file:dist/v3-D-mr2VVh-DA8uo048.js	AI (source-diff): Minified bundle of Tailwind CSS v3 plugin for prettier-plugin-tailwindcss. Standard build artifact.	ai	2026/04/23
source-diff	obfuscated-file:dist/typescript-Cg8onQ4r.js	AI (source-diff): Minified bundle of [email protected] typescript plugin; header comment confirms origin. Standard build artifact.	ai	2026/04/23
source-diff	obfuscated-file:dist/prettier-Bmp66eXw.js	AI (source-diff): Minified bundle of [email protected] core; header comment confirms origin. Standard build artifact for a prettier-based formatter.	ai	2026/04/23
source-diff	obfuscated-file:dist/markdown-BkJWkmO_.js	AI (source-diff): Minified bundle of [email protected] markdown plugin; header comment confirms origin. Standard build artifact.	ai	2026/04/23
source-diff	net-exec-file:dist/jiti-Bb1dT6Cw-DpVi6yB1.js	AI (source-diff): jiti runtime bundled from prettier-plugin-tailwindcss; network+exec pattern is expected for a module loader. SLSA provenance confirms legitimate build.	ai	2026/04/23
source-diff	obfuscated-file:dist/jiti-Bb1dT6Cw-DpVi6yB1.js	AI (source-diff): Minified bundle of jiti from prettier-plugin-tailwindcss; header comment confirms origin. jiti is a well-known TS/ESM runtime loader.	ai	2026/04/23
source-diff	obfuscated-file:dist/flow-BthqNux8.js	AI (source-diff): Minified bundle of [email protected] flow plugin; header comment confirms origin. Standard build artifact.	ai	2026/04/23
source-diff	obfuscated-file:dist/acorn-K_XpABqm.js	AI (source-diff): Minified bundle of [email protected] acorn plugin; header comment confirms origin. Standard build artifact for this formatter package.	ai	2026/04/23

Versions (showing 54 of 54)

Version	Deps	Published
0.52.0	1 / 0	2026-05-26
0.51.0	1 / 0	2026-05-19
0.50.0	1 / 0	2026-05-15
0.49.0	1 / 0	2026-05-11
0.48.0	1 / 0	2026-05-05
0.47.0	1 / 0	2026-04-27
0.46.0	1 / 0	2026-04-20
0.45.0	1 / 0	2026-04-13
0.44.0	1 / 0	2026-04-07
0.43.0	1 / 0	2026-03-31
0.42.0	1 / 0	2026-03-24
0.41.0	1 / 0	2026-03-16
0.40.0	1 / 0	2026-03-12
0.39.0	1 / 0	2026-03-12
0.38.0	1 / 0	2026-03-11
0.37.0	1 / 0	2026-03-10
0.36.0	1 / 0	2026-03-02
0.35.0	1 / 0	2026-02-23
0.34.0	1 / 0	2026-02-19
0.33.0	1 / 0	2026-02-16
0.32.0	1 / 0	2026-02-12
0.31.0	1 / 0	2026-02-10
0.30.0	1 / 0	2026-02-10
0.28.0	1 / 0	2026-02-02
0.27.0	1 / 0	2026-01-26
0.26.0	1 / 0	2026-01-19
0.25.0	1 / 0	2026-01-19
0.24.0	1 / 0	2026-01-12
0.23.0	1 / 0	2026-01-06
0.22.0	1 / 0	2026-01-05
0.21.0	1 / 0	2025-12-29
0.20.0	1 / 0	2025-12-22
0.19.0	1 / 0	2025-12-19
0.18.0	1 / 0	2025-12-15
0.17.0	0 / 0	2025-12-08
0.16.0	0 / 0	2025-12-01
0.15.0	0 / 0	2025-11-24
0.14.0	0 / 0	2025-11-17
0.13.0	0 / 0	2025-11-10
0.12.0	0 / 0	2025-11-10
0.11.0	2 / 0	2025-11-06
0.10.0	2 / 0	2025-11-06
0.9.0	0 / 0	2025-10-30
0.8.0	0 / 0	2025-10-22
0.7.0	0 / 0	2025-10-21
0.6.0	0 / 0	2025-10-20
0.5.0	0 / 0	2025-10-14
0.4.0	0 / 0	2025-10-09
0.3.0	0 / 0	2025-09-20
0.2.0	0 / 0	2025-09-16
0.1.0	0 / 0	2025-09-12
0.0.2	0 / 0	2025-09-10
0.0.1	0 / 0	2025-09-10
0.0.0	0 / 0	2025-09-10

v0.52.0

12 findings

HIGH New obfuscated file: dist/acorn-C-l7ouWN.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/estree-DHQPBKqf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/flow-Cz3mJAtC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-B_5IaZk7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-B_5IaZk7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/markdown-Eujfu-fQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/prettier-Cy-lZk4k.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-lqJOqGcK.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-BXhnMySQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-BXhnMySQ.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-CvgekpKf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.51.0

12 findings

HIGH New obfuscated file: dist/acorn-Cz3eAoi8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/estree-BL2Xy2uB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/flow-Bj4lBR-Y.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-BtDs_aWX.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-BtDs_aWX.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/markdown-CDTH7TpJ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/prettier-D7Ly-aG0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-DkgFgfZO.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-DBBWnwM8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-DBBWnwM8.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-OZwT-Lc8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.50.0

12 findings

HIGH New obfuscated file: dist/acorn-sBRpswSh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/estree-CzfNsl8m.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/flow-c9AjoQam.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-C0N20Za1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-C0N20Za1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/markdown-DVLNmbQg.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/prettier-Cw36juP9.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-C_eN_ThF.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-CU7hQIit.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-CU7hQIit.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-C8EWwksG.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.49.0

12 findings

HIGH New obfuscated file: dist/acorn-ay2Aj6GQ.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/estree-DZBnPYMx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/flow-ChhAFZSt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-DezGRPD7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-DezGRPD7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/markdown-CCrs3bBt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/prettier-s1WPCGVk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-Cgpjcksz.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-Bw8A9MXh.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-Bw8A9MXh.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-B81QD_Ac.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.48.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.46.0

12 findings

HIGH New obfuscated file: dist/acorn-K_XpABqm.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/estree-CvnLDdmw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/flow-BthqNux8.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-DpVi6yB1.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-DpVi6yB1.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/markdown-BkJWkmO_.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/prettier-Bmp66eXw.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-Cg8onQ4r.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-DA8uo048.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-DA8uo048.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-olIGVWd7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.45.0

12 findings

HIGH New obfuscated file: dist/acorn-DazAYFEC.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/estree-ClUlOUIs.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/flow-QdRUnlQt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-DzTewG1l.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-DzTewG1l.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/markdown-BOatMac3.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/prettier-CU6WrYtk.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-4s6b9-t0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-D0Hfzxl7.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-D0Hfzxl7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-BMcGKt4s.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.44.0

8 findings

HIGH New obfuscated file: dist/jiti-Bb1dT6Cw-CnTrJOrf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/jiti-Bb1dT6Cw-CnTrJOrf.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/prettier-Dwwk1Fyx.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/typescript-G7g7T3yt.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/v3-D-mr2VVh-CisVsFM0.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/v3-D-mr2VVh-CisVsFM0.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/v4-C-HWEQJm-CbHL6UrB.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.43.0