xtemplate-compiler
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist-node/index.js | AI (source-diff): Template compiler legitimately uses dynamic code generation (new Function) to compile templates. Import of xtemplate-runtime is not a network call. This is expected behavior for a template compiler package. | ai | |
| source-diff | net-exec-file:dist-src/index.js | AI (source-diff): Template compiler source — dynamic code generation is the core purpose. No actual network calls or malicious behavior present. | ai | |
| source-diff | net-exec-file:dist-web/index.js | AI (source-diff): Web bundle of the same template compiler. Dynamic code generation is expected for template compilation. No malicious behavior. | ai | |
| source-diff | net-exec-file:dist-src/parser.js | AI (source-diff): Kison-generated parser code. No network calls or malicious code execution; false positive from parser infrastructure patterns. | ai | |
| source-diff | net-exec-file:dist-umd/index.js | AI (source-diff): The flagged file is a standard UMD build artifact for the xtemplate compiler, declared in package.json as umd:main. The pattern is canonical UMD boilerplate + kison-generated parser, not a dropper. | ai | |
| provenance | no-provenance | AI (provenance): Long-standing package by a trusted publisher; lack of Sigstore provenance is a process gap, not a security indicator for this package. | ai | |
| provenance | missing-githead | AI (provenance): Established package by trusted publisher; missing gitHead reflects a publish environment change, not a security concern. No other risk signals present. | ai | |
| bogus-package | bogus-package | AI (bogus-package): xtemplate-compiler is a legitimate compiler sub-package in the xtemplate monorepo; lack of description/keywords/deps is consistent with its role as an ecosystem utility, not spam. | ai | |
| npm-metadata | no-description | AI (npm-metadata): xtemplate-compiler is a sub-package of the xtemplate ecosystem; missing description is a stable metadata quirk, not a malice indicator. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 5.0.10 | 0 / 1 | |
| 5.0.9 | 0 / 0 | |
| 5.0.8 | 0 / 0 | |
| 5.0.7 | 0 / 0 | |
| 5.0.6 | 0 / 0 | |
| 5.0.5 | 1 / 0 | |
| 5.0.4 | 1 / 0 | |
| 5.0.1 | 1 / 0 | |
| 5.0.0 | 1 / 0 |
v5.0.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.7
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: yiminghe.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: yiminghe.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.5
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: yiminghe.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: yiminghe.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
6 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: yiminghe.