@aurodesignsystem/design-tokens
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs a local .mjs script for token generation; consistent with this package's documented design-token build workflow. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): postcss is a runtime dependency used in CSS transformation scripts; heuristic false positive for this build-oriented package. | ai | |
| phantom-deps | phantom-dep:@aurodesignsystem/auro-tokendefinitions | AI (phantom-deps): Same-org token definitions package; used at runtime in postinstall/build scripts, not directly imported in JS modules. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 9.3.1 | 0 / 18 | |
| 9.3.0 | 0 / 18 | |
| 9.2.0 | 0 / 18 | |
| 9.1.0 | 0 / 18 | |
| 9.0.0 | 0 / 18 | |
| 8.21.2 | 0 / 18 | |
| 8.21.1 | 0 / 18 | |
| 8.21.0 | 0 / 18 | |
| 8.20.0 | 0 / 18 | |
| 8.19.0 | 0 / 18 | |
| 8.18.0 | 0 / 18 | |
| 8.17.0 | 0 / 18 | |
| 8.16.0 | 0 / 18 | |
| 8.15.1 | 0 / 18 | |
| 8.15.0 | 0 / 18 | |
| 8.14.2 | 0 / 18 | |
| 8.14.1 | 0 / 18 | |
| 8.7.0 | 3 / 10 | |
| 8.2.2 | 2 / 10 | |
| 8.2.1 | 2 / 10 | |
| 8.2.0 | 2 / 10 |
v9.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.16.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.15.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.14.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.14.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.