@atlaskit/legacy-custom-icons
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed-stale | AI (provenance): Same Atlassian publisher migration, long-stable on npm. | ai | |
| source-diff | obfuscated-file:dist/cjs/ui/bug-icon/index.js | AI (source-diff): Compiled SVG icon component with long inline path data, not obfuscation. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Known-maintainer email match, long-lived on npm; internal Atlassian publisher rotation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New icon component files matching added af:exports entries, not injected code. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Expected growth from added icon set, consistent with package purpose. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @atlaskit/tokens is a standard first-party Atlassian dependency. | ai |
Versions (showing 32 of 32)
| Version | Deps | Published |
|---|---|---|
| 0.22.20 | 5 / 7 | |
| 0.22.19 | 5 / 7 | |
| 0.22.18 | 5 / 7 | |
| 0.22.17 | 6 / 9 | |
| 0.22.16 | 4 / 9 | |
| 0.22.15 | 4 / 9 | |
| 0.22.14 | 4 / 9 | |
| 0.22.13 | 4 / 9 | |
| 0.22.12 | 4 / 9 | |
| 0.22.11 | 4 / 10 | |
| 0.22.10 | 4 / 11 | |
| 0.22.9 | 4 / 11 | |
| 0.22.0 | 4 / 11 | |
| 0.20.3 | 4 / 11 | |
| 0.20.1 | 4 / 12 | |
| 0.20.0 | 4 / 12 | |
| 0.19.0 | 4 / 12 | |
| 0.18.0 | 4 / 12 | |
| 0.17.0 | 4 / 12 | |
| 0.16.0 | 3 / 12 | |
| 0.15.0 | 3 / 12 | |
| 0.14.0 | 3 / 12 | |
| 0.13.0 | 3 / 12 | |
| 0.12.0 | 3 / 12 | |
| 0.11.0 | 3 / 12 | |
| 0.10.0 | 3 / 12 | |
| 0.9.0 | 3 / 12 | |
| 0.4.0 | 3 / 12 | |
| 0.3.0 | 3 / 12 | |
| 0.2.0 | 3 / 12 | |
| 0.1.0 | 2 / 12 | |
| 0.0.1 | 2 / 12 |
v0.22.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.22.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.0
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (atlassianartifactteam) than the most recent previously approved version (atlaskit) on 2025-02-24. It has since remained available on npm for 510 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.20.3
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: atlassianartifactteam.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
This version was published by a different npm account (atlassianartifactteam) than the most recent previously approved version (atlaskit) on 2025-01-17. It has since remained available on npm for 548 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.20.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-12-03, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.20.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-27, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.19.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-26, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.18.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-22, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.17.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-21, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.16.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-18, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.15.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-15, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.14.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-15, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.13.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-05, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.12.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-11-04, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.11.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-10-29, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.10.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-10-25, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.9.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (atlaskit-user) than the most recent previously approved version (atlaskit) on 2024-10-24, but atlaskit-user is listed as a maintainer on prior approved versions (matched on email). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.