@aurodesignsystem/auro-tabs
auro-tabs HTML custom element
6
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
capsule42dale.sandeblackfalconbraven112jordanjones243alaskaairlinesits-admindougalaskarmenner-aa
Keywords
alaska airlinesaurodesign systemweb components
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/auro-tabpanel-BOxEbwY9.js | AI (source-diff): Minified lit-based bundle output, not true obfuscation; matches package's web-component purpose. | ai | |
| provenance | publisher-changed | AI (provenance): Change reflects CI/CD provenance adoption (GitHub Actions), an improvement not a compromise. | ai | |
| phantom-deps | phantom-dep:@lit/reactive-element | AI (phantom-deps): Used transitively via lit; common false positive for lit-based components. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.3.0 | 2 / 6 | |
| 1.2.0 | 2 / 36 | |
| 1.1.2 | 2 / 36 | |
| 1.1.1 | 2 / 36 | |
| 1.1.0 | 2 / 36 | |
| 1.0.0 | 2 / 36 |
v1.3.0
3 findings
HIGH
Publisher changed: rmenner-aa → GitHub Actions (on 2026-07-02)
provenance
This version was published by a different npm account than previous versions on 2026-07-02. This could indicate a legitimate maintainer transition or an account compromise.
HIGH
New obfuscated file: dist/auro-tabpanel-BOxEbwY9.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.