@atlaskit/teams-public — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

atlassianartifactteam

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): All new deps are @atlaskit/* scoped packages from the same Atlassian monorepo; no unvetted third-party additions.	ai	2026/07/06
phantom-deps	phantom-dep:@atlassian/react-compiler-gating	AI (phantom-deps): Same-org Atlassian package declared for config use only; stable false positive for this package.	ai	2026/07/03
phantom-deps	phantom-dep:@atlaskit/logo	AI (phantom-deps): Same-org scoped package in monorepo; phantom dep is expected pattern for workspace dependencies.	ai	2026/04/26
phantom-deps	phantom-dep:@atlaskit/icon-lab	AI (phantom-deps): Same-org scoped package in monorepo; phantom dep is expected pattern for workspace dependencies.	ai	2026/04/26
dependencies	unvetted-dep:react-intl-next	AI (dependencies): react-intl-next is a well-known npm alias for react-intl@^5.18.1, a legitimate i18n library. Atlaskit packages routinely use this alias; stable false positive for this package.	ai	2026/04/25
phantom-deps	phantom-dep:react-router-dom	AI (phantom-deps): Phantom dep referenced only in config files; common monorepo pattern for this Atlaskit package, not a security concern.	ai	2026/04/25
phantom-deps	phantom-dep:@types/string-hash	AI (phantom-deps): Framework-scoped type package loaded by convention; not a security concern for this Atlaskit package.	ai	2026/04/25
phantom-deps	phantom-dep:@atlaskit/tokens	AI (phantom-deps): Same org scope phantom dep; common in Atlaskit monorepo packages where tokens are loaded by convention.	ai	2026/04/25
phantom-deps	phantom-dep:graphql-tag	AI (phantom-deps): Phantom dep referenced only in config files; common monorepo pattern for this Atlaskit package, not a security concern.	ai	2026/04/25
phantom-deps	phantom-dep:graphql	AI (phantom-deps): Phantom dep referenced only in config files; common monorepo pattern for this Atlaskit package, not a security concern.	ai	2026/04/25
provenance	no-provenance	AI (provenance): Atlassian's atlassianartifactteam publisher has 244 approved packages without provenance; this is a stable publishing pattern for this org, not a risk signal.	ai	2026/04/25