@0xsequence/connect
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/cjs/components/Connect/Connect.js | AI (source-diff): Standard tsc-compiled minified React component, not true obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): tailwindcss/@0xsequence/network are legitimate first-party/well-known deps tied to build tooling. | ai | |
| source-diff | obfuscated-file:dist/cjs/connectors/epic/EpicLogo.js | AI (source-diff): Long lines are inline SVG path data in a CJS-compiled React component, not obfuscation. | ai | |
| phantom-deps | phantom-dep:tailwindcss | AI (phantom-deps): Build-time CSS tooling referenced in config scripts, not a runtime import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/metadata | AI (phantom-deps): Same-org transitive dep; used indirectly via other @0xsequence/* packages. | ai | |
| phantom-deps | phantom-dep:@tailwindcss/cli | AI (phantom-deps): Build-time CSS tooling referenced in config scripts, not a runtime import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/utils | AI (phantom-deps): Same-org transitive dep; used indirectly via other @0xsequence/* packages. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 6.0.9 | 14 / 14 | |
| 6.0.8 | 14 / 14 | |
| 6.0.7 | 14 / 14 | |
| 6.0.6 | 14 / 14 | |
| 6.0.5 | 14 / 14 | |
| 6.0.4 | 14 / 14 | |
| 6.0.3 | 14 / 14 | |
| 6.0.2 | 14 / 14 | |
| 6.0.1 | 14 / 14 | |
| 6.0.0 | 16 / 15 | |
| 5.4.12 | 15 / 10 | |
| 5.4.11 | 15 / 10 | |
| 5.4.10 | 15 / 10 | |
| 5.4.9 | 17 / 10 | |
| 5.4.8 | 17 / 10 | |
| 5.4.7 | 17 / 10 | |
| 5.4.6 | 17 / 10 | |
| 5.4.5 | 17 / 10 | |
| 5.4.4 | 17 / 10 | |
| 5.4.3 | 17 / 10 | |
| 5.4.2 | 17 / 10 | |
| 5.4.1 | 17 / 10 | |
| 5.4.0 | 17 / 10 | |
| 5.3.26 | 17 / 10 |
v6.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.12
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.