.cache-loader

024cb4c99b939d121e783bdf4d0e8a7a.json

039609c0d50de4cf15c6f8387e8a51d1.json

0403dc23407cc760440b68ea625c6d7f.json

06d0e55cb7c6b7feb610c12a3000421e.json

091e8012f59d11cbda952914cc43f635.json

0e1ce61bc733ccd7b2e829df2898eea8.json

0ffa0e9248a214fd0ddfa96929fbf3e4.json

1062d37c8c5efa7afde9a01dd04d8672.json

10b704afd5ab36691e6552be2a576f2e.json

10d699325452e3da44ca2bdb174117ea.json

1178306387c50c96a3d8b0d94e90b946.json

11900d62593bab054b2a02ba58457b34.json

130b19e9f85864d997becb55090c2b6c.json

14f9769f3e044bce878dd3025ae077c3.json

18407c852bb059089099c2a38b918f74.json

1f59f298d47596b7e8d79f83e019b24e.json

20bf12992b127a30c3feed3f2f6fde6b.json

21062fce2603564cb76f932d232622b7.json

2269cf47050c2f7be252cfdea80092cb.json

22f4473b9acfb9bb1a6af7ff657f7dea.json

241f3a51c2fce4914b34508a1217545e.json

24d1577d49ffdc94fda3426197d3d0c7.json

24fe923201d1fc1754056659fa015d94.json

26a877cecea8e22e049151aabaedab65.json

284ec3c3a0a3da97ad5557ce4b01319c.json

29fb22f686b7562d77d8dcd2bef68693.json

2a683f115b8dd5a29775644aa315d23f.json

2adf9f3f33b1c3d9afcacade7e2c6880.json

2b4ae8c6c680ad1ec8ba5c97dd2b200f.json

2b73bd847573c5f48646e0ae7cee400a.json

2c7819347aa202b2c9a2ea1ad6123959.json

2d8856da1b7a9825fa4a48d436972101.json

35b6d0ad8ca1637a23fb8e3a75222d69.json

366def3c8c4ebeeaacfde5fc1e1aadd7.json

3ac9ef762de2037b134cb16409ab25a6.json

3d0df12982c821e9915a4b73c3556241.json

3ded5d9f96798d3de463727f197a4be5.json

3e4a403cef89bde9c2a9d6dff9c7b85b.json

3e88a2f44db2ed0a22af7800d2580868.json

408f338ef7351230b5658c5bc02fd200.json

416b15e485c7b0e85bd02d644fd9b484.json

4227e2ded538e651b8c365df5791482e.json

4687d2b3507079fbe663cce673f358fd.json

4cea6035ac9d4adf3cc446fa63bca975.json

4db31eade5eec0606369a603c94827b2.json

4f17b88f76d28289bbe80875ff4b5180.json

51ce03bbb799e7fa28c4880593bef8e7.json

5279142397b7fa80ba9bb09fe676b5d1.json

553066185af563af1d9c0279f3de8983.json

58b55a950c3106c6dbeb912312945a9e.json

5a94f6b3c53ae0427590fc861404a042.json

5e6027f5e3dcab03ea47de843ec20838.json

5f673b4bda807fcefac2c43bb6c2d976.json

617d9b3dd4182b4c3149cada4ae264a0.json

61f8cfa7dfdba9e8899499aeb6a89aa1.json

64d09bcd67718b5d36e63017f5a978d2.json

6792a1bd30ee21528d3e16796ac33538.json

6a3d9a669a6e96332753b9c83c302947.json

6e61e0dc706a949aaf67031ceb5bb6ab.json

74964c0f2c4e826fa411b487781435be.json

74f8b32d1be3ffc39a21e38d5f698044.json

7829eca947e210a6312794a99f52f12b.json

7a5c86dd657f1b75107f0674ee7e9550.json

7b1f018071b72e4cb2e1830eaf55119b.json

7be241a5234fe6589fb480a3ee544757.json

7e11354e635563df6651feba3ef2e94e.json

7e7e82c0164bce386e2ec9698e1f65d8.json

82045a1b258d4a5f17e3c2dc3cc1add3.json

85449f3db862b25bb7713813bb6b542e.json

86633592e6eb8118dd8de4e9842b854d.json

8688fb36f42305bf2a0747df5cd13cdd.json

8f207800f4e5933cc1c7e09afd794ee8.json

90e180211dce2805884a861972ebf361.json

9116b84144639334e00b975c543a544a.json

927ed6363ea921e1590a15cf074e42b3.json

93b7aa9f03be171e35f2adad48705959.json

9951029af61caf41c6422b60257cdff8.json

9a740a123c4d1f770cadf1a0267526f3.json

9b8ca21adb86c14474dc4947b06c7e5f.json

9dc02aa7ea55c56c3c328c24bd5d741b.json

a47f452a66d9fbfb1c17a9dd0a28ca42.json

a4fbc548f426dc5bcd32be7e02e55a0a.json

a5193f5521d96e5c70f7b21e481e47fc.json

af04cad5ceb3e9d0a6024b5c3767dfb7.json

b02d84796d272790963bcec6d34e655a.json

b04e2311fe99d3b853b2e515693c1ef8.json

b80cb3de8a61532c44ae62aaf6d1ec88.json

ba5b5bd9eb430226d63b8b99f82d239d.json

be8b876bcba78bc3649115e16494e50e.json

c02fc2c33d2140adab4b9af3900576d8.json

c106c43883f2d8e96fc81e7949a77994.json

c1db5b83512327a0da46f3aa765a0d3d.json

c3af55160ce817c4300c3dbebab9014c.json

c4f67ba815222fe3c9c40dd25b967a8b.json

c70edcb2c1dc632460e2dfaa8997a2cb.json

c96c5c222bd6fc6a2ddfd2daf7d33918.json

ca92b8955f2cfc5da52415ac9fe9ea3b.json

cc9e744dc37708be0486cd25dafe64df.json

ccd24e3cc0c63ac49d9bf1648b911f9b.json

@spinnaker/amazon

christopherthielen

ranihorev

ajordens

alanmquach

chebebrand

dpeach

erikmunson

spinnakerteam

vigneshm55

anotherchrisberry

jrsquared

svachalek

amazon

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

@spinnaker/amazon - npm Package File explorer