[![Slack Status](https://img.shields.io/badge/slack-join_chat-white.svg?logo=slack&style=social)](https://www.influxdata.com/slack)

.eslintignore

.prettierignore

.rpt2_cache

rpt2_29818c6811f044697d9ba281b519ad6045cbd5df

code

cache

0130e0faccdbbac5964380127186f3479e9f4d66

01734ed8ae5221ca9f762944299cdcf99caf3cc1

04715e9e74b87b0864b2f1b44e4bf0fc323c0b17

1095e93444f96ffdc01595c4711e3217cc616b13

1867ac1f55c96049e3da3f70da77d3517a791a2a

18f0275542d5ccae6776a28e80858f2627c03ae4

1a4e1571a4d01c2ea66ec34db57a005da3d87f54

1b2d122be62f63ee036394ee87e24bf1bab18b94

1bdfd0f6f914e52ba9a240467a0045e69777f726

219f207018756e8314a081520d15158a0edbe33d

26d350e4bf760e3780ff17df2561ac625d9c25e8

28d8072774e95e0178fb71b3ed1497c3bc8c8883

2f2d1924dd2cf82f115a73039354b4400e84ddcd

2f8d2c8be6dea66093415ccb69ac49ea7574ea55

301a7f6c9a3093686e28f8b068242b55ebbd9ae5

33174984ec918c5e35dccb84bf96f918f85b5704

390575e95a0918e13403eb4264febe4e401c240e

3dabea7e62bc01c923724105eace77f85882293c

41eafe0f2ae4e4030db935bc7c30bef6c68d9844

4360101b193a12d41925203c0cc04be145bb3100

51e2f9d0d77be53fb26ac3c348086c81334d3e05

566a46a411f2a5823436dac3832dc224b897647e

63f8912f20ae85e3eb9ca90e3cfb7f9e5b0be4ac

6a31c3a755824408c16633c88dbf47a555603f8e

6ae93ea6d1ffe4d52336a5e29f5f81ad79f92d4a

6ba8e0be63fcadcff3e7de7093bbcb72cd1a37d9

6e3ebf04e39f3af0bafc68f89d937c8446591921

742ef3311e70bc65461b0eeda65c113045be0ee6

753b55d074a4230434e7080ebaaf7e54ec1270fe

76bfbac915ce7a6bf5d064ecde068a1b3e8c86ee

8078dde5c832f65ed80e33652188a3a7424db107

8426362645f9c46c18622a7eb29f7f4edc0e9ea0

87fa4517fb975be7b27faf179ffb794ecbc2bd7c

891e8254aebc51d045e03923c75cfb620b3c637f

8caa705067a3265dbca855b9e754aa3edf9b7757

8ec42aa24f6c9ac25b983340e2ad3a1d193e138a

9576acfab5baea918e3027ba394717424e3d568d

972bb94d4f8fc168ff982c80334638a08f19ed49

9d26c165d0f83f4f680c14d8f1dba2d85c774b68

9d9de0b0b98e7f39ad977ac2e782ce26b5325df8

a5ed3a3e38f1888d3916bff548cca3abad268cb0

a766b93640286892950af58fd5bdfe590adaa438

b5c48b558cbd91a22ea4551de7db39bdd3f56919

bef35df17e250b8318195dc55c0c8de9d2e06149

c5e00427b384cb7385b5ae5e153238e949c0c221

c73af96c350554e4f74efc2e21329c7531d9a98e

d27bf52f590417fc6849e80a11f8892cde0293ff

dcf0e02732e1c5ef968003be9706b1ee8a32be84

e35198afaed7c8707744b50aaf3b751d6c8f3549

e8679924b262926058d6e2cddbabe660adb7cd8f

e89f264dab96ff8fe2992374a67734fc5db0f9f4

ea1e92900e475c14ae5cd22b3b428d01704005e6

eb618b41249087492cb1b0825dc3c49f674f6a90

ec28be25338c423861c55ee062e7d72694a57d21

f20a1951cfe0d5bbab0666066e241ecacdb7d1ed

f7ff1389b6cfba01f6e3be92ab17d52c7a22eb1a

f941302a759c39f5d987e2e7f0f20080bf688cff

fba2c1a9421912ac3590901f5c83371ed1069739

ff7691bc1ef118067b7a10b2db3a1825a0700262

semanticDiagnostics

Announcing our $40M Series B led by Abstract Ventures

@influxdata/giraffe

drdelambre

bednar.b

bnelson_influx

chitlangesahas

genehynson

hoorayimhelping

influxdata-ci

influxmark

jzbridges

mavarius

monono

nvcook42

reed_de_la_mer

rhajek

scbrickley

tcl735

zoesteinkamp

subirjolly

chunyellow

brandentenbrink

blegesse

asalem1

wdoconnell

myalongmire

popeydc

reimda

sspaink

mrpowersj

palakbhojani

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

@influxdata/giraffe - npm Package File explorer