.heft

build-cache

heft-jest-data.json

jest-cache

haste-map-bae913f9b9aa720eb4deeae0a60a4b27-22ae7f4ce9de4306889d8c05e5cc39b9-f6b1af01a3130057bdfe3d86807211f9

jest-transform-cache-bae913f9b9aa720eb4deeae0a60a4b27-474488b31a4a940a3990e9eaf06f1647

CommandLineParser_0096ef3e73a0458d2c4e987ce6950ec8

jsonfile_001c9f2c4a38c3ac08d195a597f3f40c

action_container_0168facd9c19526b921c2a176ff5e3dd

getPackageDeps_02bf27e4c49bd0d60a0d2a807f58ad64

CommandLineChoiceListParameter_039f877c10997d8689457a3cc6126b9f

Hook_044e3585bd11395575af5f860b3449ca

StdioWritable_0514ac0d19d8447acf4fc997d4eb75c2

ConfigurationFile_06d7f35feb0bd944d9b9a2a4d9e112c8

FileError_07e325c2d038b4cc56e1dfe3830d6c3e

ltr_0715ee1731dbedafe7e26cfb1315c8db

homedir_086be402c636b5ef75b92acd986cbbcf

outputjsonsync_08a1ad9a9786d59f137a5ea6e1547f10

Path_0996303466a12a84e221f1ca7e815489

constant_0bebc93b25bd88f8e9694b48db821b00

index_0b2321eff214a8a8c920ed4d283d606f

gracefulfs_0c1a237496d918be613bce417baa89f2

indexumd_0dd8b4985260e5d98d86cd77c5feca27

index_0e154b4f09da1ddc6c89567be99e1184

StringBuilder_0f79d7bd9ef44b22de47594852bebf54

index_0f086ad263aa8ec1c88455f1c863d9c3

CommandLineChoiceParameter_10f873b895c0c8bbfff1b3ca3be44551

PackageName_11306194785ccb2ba264a8e77c4109de

runTest_12014d70f30cb7039d4e026bacc47665

index_14189dd0bf5b37d264e85be625b19df0

lt_15449967a28afb6ec5dbb008da254f3e

copysync_196045f8ccef3c2f2f82113b3d6322ea

intersects_1920dd31d7a2b696c913c6105b7aea5a

index_1a09c4b40e031dcc3464bf0de8642956

tocomparators_1a8990095d92cfa18e5a3c7547951f9b

index_1b7c45ee5c2dbabcedc41ab6b1e02377

CollatedWriter_1c603fd6e169333da45c34e3c6aba4f3

ScopedCommandLineAction_1d44a994459da880ecd53a33e4e612aa

index_1d071d1d9c16561dc536eb16f991e9d1

index_1dcfbe32546c5f673f2b614530fce0ef

safe_1fecf14f4050ef9c0f88c3c1e2dd85a8

CollatedTerminal_204a6de6c99e4c915d6221e230a0fa4e

index_210551fcae12c5b3d27a6b0775228781

coerce_224b5791f8f7b7cee6fac3237e26755b

core_2267298cab4959e0bc6a302739275617

index_226f648122f5302b23da56fe470c16ac

supportscolors_2218a76b76fd61532d614e1b0bb928fd

urlstatemachine_2208634a5a2ffd9728d9dafaf9451e2d

AlreadyReportedError_23dbb838b51752afa3d8495f3062de58

minsatisfying_231e7868208d4f1c9e82cecdce4c81ef

error_245d118d6aaef020e6c9b74d975e24d7

Enum_26f7c648b8042f36def6f28b90b3995f

index_269839caa72382caf6110fdff62b8b0f

package_263c59db6933ba9581588638fb19da5c

symlinkpaths_269231f2a465387e8122e02bc23a585b

AsyncParallelBailHook_277e441e1512e36622369a45ebd3f58b

index_272b3290b49eb1250dd5383c4066d1d6

index_27f9c09249b0c27a2bfad978196e060d

subparsers_2863fbc004ea15cbe9570a59d7688f82

maxsatisfying_2a5f074207b66570ea099648b0cc07a2

win32_2aa3d38608b9c19fb22bc6e49e6c17d8

AsyncSeriesHook_2cb49a136f5dc18080ce2e75c6c685e7

core_2cedf8a7e3f663d3d09ca6789bdf0c46

Rush plugin for generic HTTP cloud build cache. 

See how Anthropic automated 95% of dependency reviews with Socket

@rushstack/rush-http-build-cache-plugin

Rush plugin for generic HTTP cloud build cache

odspnpm

octogonz

rushstack-admin

rush-http-build-cache-plugin

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

What are invisible characters?

Invisible chars

(Experimental) Package license has recently changed.

What is a license change?

License change

(Experimental) Contains an SPDX license exception.

What is a license exception?

License exception

This package is not allowed per your license policy. Review the package's license to ensure compliance.

What is a license policy violation?

License Policy Violation

Contains long string literals, which may be a sign of obfuscated or packed code.

What's wrong with long strings?

Long strings

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

@rushstack/rush-http-build-cache-plugin - npm Package File explorer