@atlassian/aui
Atlassian User Interface library
7
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
atlassianartifactteam
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/aui/aui-prototyping-design-tokens-base-themes.js | AI (source-diff): Webpack-bundled CSS design token file; long lines are CSS variable strings, not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:dist/aui/themes/typography-modernized.js | AI (source-diff): Webpack-bundled CSS typography theme file; long lines are CSS variable strings. | ai | |
| source-diff | obfuscated-file:dist/aui/themes/typography-adg3.js | AI (source-diff): Webpack-bundled CSS typography theme file; long lines are CSS variable strings. | ai | |
| source-diff | obfuscated-file:dist/aui/themes/light.js | AI (source-diff): Webpack-bundled CSS theme file; long lines are CSS variable strings. | ai | |
| source-diff | obfuscated-file:dist/aui/themes/legacy-light.js | AI (source-diff): Webpack-bundled CSS theme file; long lines are CSS variable strings. | ai | |
| source-diff | obfuscated-file:dist/aui/themes/legacy-dark.js | AI (source-diff): Webpack-bundled CSS theme file; long lines are CSS variable strings. | ai | |
| source-diff | obfuscated-file:dist/aui/themes/dark.js | AI (source-diff): Webpack-bundled CSS theme file; long lines are CSS variable strings. | ai | |
| dependencies | unvetted-dep:jquery-form | AI (dependencies): Long-standing dependency in this established Atlassian UI package; no malware indicators. | ai | |
| dependencies | unvetted-dep:skatejs | AI (dependencies): Long-standing dependency in this established Atlassian UI package; no malware indicators. | ai | |
| dependencies | unvetted-dep:skatejs-template-html | AI (dependencies): Long-standing dependency in this established Atlassian UI package; no malware indicators. | ai | |
| dependencies | unvetted-dep:@atlassian/fancy-file-input | AI (dependencies): Same-org Atlassian scoped package; low risk for this publisher. | ai | |
| dependencies | unvetted-dep:@atlassian/adg-server-iconfont | AI (dependencies): Same-org Atlassian scoped package; stable dependency for this package. | ai | |
| phantom-deps | phantom-dep:css.escape | AI (phantom-deps): Stable false positive for this package; referenced in config but not a runtime risk. | ai | |
| phantom-deps | phantom-dep:@atlassian/tipsy | AI (phantom-deps): Same-org Atlassian dep; phantom-dep heuristic unreliable for bundled packages. | ai | |
| phantom-deps | phantom-dep:trim-extra-html-whitespace | AI (phantom-deps): Referenced in config files per finding; stable false positive for this bundled package. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Long-standing keyboard shortcut parser pattern in AUI; not user-controlled external input. | ai | |
| phantom-deps | phantom-dep:@atlassian/adg-server-iconfont | AI (phantom-deps): Same-org scoped package declared as dep but used indirectly; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped @atlassian package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @atlassian package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped @atlassian package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped @atlassian package; Levenshtein match against short names is a false positive for this namespace. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped @atlassian package; Levenshtein match against short names is a false positive for this namespace. | ai |