.cz-config.js

.github

ISSUE_TEMPLATE.md

PULL_REQUEST_TEMPLATE.md

.nyc_output

03c75f934e3bd60aff322f656b8b8da6.json

03edfa801ae59c78f191cc63cc747746.json

04398ae6a10341db0f4e98ed0ba87937.json

0869f312f64e0bc19513dc0ecc54a3d0.json

09352f72bf8419f3025b90a0f761e474.json

0b1ccbeb9074f8074e6968d0f26feaf8.json

0cdad65729e137aed3ad20d11283430c.json

0d4d304469733fefb21ebcb4bdce4b34.json

0defb770cacd98b31b1acbe299ee7d0a.json

0edc609c30a411822bd13933b0b8e6a7.json

0f0d60a3fe46d0be1ad39b0eb2fad0c6.json

0fbea06545dac0c99d525b16adf78b86.json

19449e876a7215f57bfe34adb1aa5a9a.json

1a424b5ba4bd7fcb86a115749e4941d0.json

1a948b37896fffd29eb444a533d7b6d6.json

1d1f886f2ebdb8f515cac92d16ee11f3.json

267e6c41ac6ee9077a97b93349ed5e81.json

284102e8799d3ebff1f8a944f349276b.json

290f1721af40cdd0d593740d5407a120.json

29c463a54ad6f0abf591cab85c9ecabc.json

2a0b256aacbf9f88ac5741f2254aadb3.json

2a1a14ea7622b06145c5c326422ba958.json

2b29e59bae7565b9241f923e752837c3.json

2e978b64afa2bdd314df6e23dbc8084c.json

318e816fd7075fee42a78916fecfcab8.json

3424c03c5cdf23bff7006381fd471e02.json

358bfa1abc0ed4c8536c86840b0ccd51.json

38e192e82655661eb6c5dd9a32de22cc.json

3baec9183763f3df16078ca84488ea86.json

3c166f66ea66eb4f07c3c82fd4b76636.json

3fe07a749844709cfb376d6e2907910a.json

4095d473bb5c5495f1852dbe5be1c670.json

431c1df8c5e21f1f97d53881d6afad6e.json

4596c531a885f8e265e33cdae85e2d38.json

468c22c9bdc28f813cbe5714142cd63f.json

48d2386136541143ee94c50f818eb25c.json

4ec8246963c58caa89e8be66f154f3f5.json

54fac303c485944a6752d89460b040aa.json

56e5004c04445807d9731b48ee2f6c46.json

594acacac685f46b34597a2772a46383.json

59fd244fa657a6195e0987db94c3f23a.json

5d9702e69e3697e181bb42e9ecbd96e3.json

5ee1d2eff29e10ca31babde3c4248350.json

60ba43778c5f421d0bd7e697635d33c6.json

610b571249785b001bc99b7e43ba1127.json

636bf853f0665d4d43a45811a617ccc2.json

639e34d8f8eeda7807217eb57fc7db6d.json

6458f72e2f4967efd1772e7a5e5d80af.json

65fc8beb977782a9bd1f80d9ffb977c3.json

68105586c8b573674e5154086d28db07.json

6925d43058550c19de731af753957e53.json

693c6bff2c310362e983ed3944fa5ff1.json

69b4956f086eedfc0a51346cd824b388.json

6af569c324546f3c911673da816b0d38.json

6b36c0bdb3b4f733d50714d3f55130f1.json

6d88ed657e842b4ae38bb8dbceaec071.json

7173442ca86cc9cd3b1649980123cdfd.json

7310f6b961de1f6bfe3b23812a20f2b6.json

760a2e9cf5f33c5680b7abb440c85000.json

79aa99cc3c65b77da1a806daf45717c0.json

7ba7086d8e331c428d1c79f91c85e108.json

7dd96c698d5b40c4ab67c453ca5f894c.json

7f8249f833d0a545fd25655a67af2df2.json

805723796af9a918dabd694f9f55275a.json

82f736633a35e8cd916994094e481c88.json

842a510a16337545452f4afebe9d10c2.json

8484e7a2d2b16a8a33c56ea0eff5f82f.json

85bf9ba713ec5cb638e24ae941afe005.json

8741f61050e924fe41cce64a174bba41.json

8c4f4a12716557ed6460dc44f302d174.json

8c77a831dcc97c92f78afc97f4d16593.json

8d24310f4c4b357db27c448d98e8fe1a.json

90ebf8b8ea910f938b60a20968536971.json

9464250e65f9cdf9da72d38c55f104a9.json

97d5eb33e908d60253b1896c70a954a8.json

98129673bded60d2ed023c3007122034.json

9d32cce5ead33a1fd59d5b7b89a6957c.json

a116d3e10b882fa2fe5727fd578e4007.json

a1ffd0bd2f0c3bcc1618d7124c683954.json

a301d70a95806439ceaaeb85f30270d6.json

a62edab1fa1ca6affbb5ff37c084c9fa.json

a9d48405c518bbad54a86ec91e626596.json

aa73b55b33800c59d665daea662d6d13.json

ab995e7ce5f1bc883ddb64647e619381.json

b1e28576923b19af73632777f55632c5.json

b2141974e843e744fb6ebc10bf745079.json

b2a037710afcd634a5c3ebafc120ef21.json

b2ad08bd02d8af116409c488ed60c0e7.json

b2f2136670de0e0ade14a684f9fb5d78.json

b6ee5a22efbef780bf5cbb7229161056.json

b932d21e0121d49f3f63ddc648ae3a5d.json

bcf9e165844bb87bac721511113b0172.json

be111b481fd00ce6891d847db6fcce8c.json

be7f934629a26e1353c10eb13856c31e.json

c1ab6dfe385b2a671b162605bebea4bd.json

Announcing our $40M Series B led by Abstract Ventures

webpack-cli

evilebottnawi

ev1stensberg

ematipico

bebraw

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

webpack-cli - npm Package File explorer