@axinom/mosaic-ui — Greenflagged

UI components for building Axinom Mosaic applications

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

schwendneraxinom_kuzminruwanxaxinomnpm

Keywords

axinommosaicaxinom mosaic

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	dormant-publish	AI (publish-pattern): Axinom org package with 950 prior versions and vetted publisher; gap likely reflects internal release cadence change.	ai	2026/05/12
dependencies	unvetted-dep:@mui/base	AI (dependencies): @mui/base is a well-known MUI package; beta pin is intentional for this UI library.	ai	2026/05/12
phantom-deps	phantom-dep:postcss	AI (phantom-deps): postcss is a build-time dep used via rollup-plugin-postcss; phantom-dep false positive for this package.	ai	2026/04/30
phantom-deps	phantom-dep:@axinom/mosaic-core	AI (phantom-deps): Same-org dependency; phantom-dep heuristic unreliable for monorepo/workspace packages.	ai	2026/04/30
bogus-package	bogus-package	AI (bogus-package): Proprietary internal UI library; no public repo or README code blocks expected for this package type.	ai	2026/04/30

Versions (showing 3 of 3)

Version	Deps	Published
0.70.0	18 / 51	2026-05-21
0.69.0	18 / 51	2026-04-23
0.68.3	18 / 50	2026-03-12

v0.70.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.69.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.