@baloise/ds-core
The Baloise Design-System is an open source project for styling awesome web applications that follow the Baloise corporate styling guidelines.
5
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
yannickholzenkampbaopsohirsch88nobiloteam_mortalmadalina.iacobmontakasparsoneassistentenitch
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Large number of new files is expected for a design system adding new components across multiple build targets. | ai | |
| source-diff | obfuscated-file:dist/cjs/bal-check_7.cjs.entry.js | AI (source-diff): Standard Stencil.js minified component bundle; consistent with this package's established build output. | ai | |
| source-diff | obfuscated-file:dist/esm/bal-check_7.entry.js | AI (source-diff): Standard Stencil.js minified component bundle. | ai | |
| source-diff | obfuscated-file:dist/esm-es5/bal-check_7.entry.js | AI (source-diff): Standard Stencil.js minified component bundle. | ai | |
| source-diff | obfuscated-file:dist/cjs/bal-radio_3.cjs.entry.js | AI (source-diff): Standard Stencil.js minified component bundle. | ai | |
| source-diff | obfuscated-file:dist/esm/bal-radio_3.entry.js | AI (source-diff): Standard Stencil.js minified component bundle. | ai | |
| source-diff | obfuscated-file:dist/esm-es5/bal-radio_3.entry.js | AI (source-diff): Standard Stencil.js minified component bundle. | ai | |
| source-diff | obfuscated-file:dist/esm-es5/breakpoints.subject-PxavGndB.js | AI (source-diff): Standard Stencil.js minified utility bundle. | ai | |
| source-diff | obfuscated-file:components/bal-switch2.js | AI (source-diff): Standard Stencil.js minified component bundle. | ai | |
| dependencies | unvetted-dep:lodash.isnan | AI (dependencies): Standard lodash utility; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:contactjs | AI (dependencies): Legitimate touch/gesture library; consistent with a UI component library's needs across versions. | ai | |
| dependencies | unvetted-dep:lottie-colorify | AI (dependencies): Lottie animation utility; consistent with design system animation features. | ai | |
| dependencies | unvetted-dep:@baloise/web-app-utils | AI (dependencies): Same org scope (@baloise); stable internal utility dependency across versions. | ai | |
| phantom-deps | phantom-dep:contactjs | AI (phantom-deps): Referenced in config files per finding; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@baloise/ds-icons | AI (phantom-deps): Same-org sibling package; phantom-dep heuristic is a stable false positive for this monorepo. | ai | |
| phantom-deps | phantom-dep:@baloise/ds-styles | AI (phantom-deps): Same-org sibling package; phantom-dep heuristic is a stable false positive for this monorepo. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 19.10.0 | 21 / 8 | |
| 19.9.5 | 21 / 8 | |
| 19.9.4 | 21 / 8 | |
| 19.9.3 | 21 / 8 | |
| 19.8.3 | 21 / 8 |
v19.8.3
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.