@blueprintjs/select
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Established org package; missing gitHead is publish-env noise, no malicious behavior. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @blueprintjs/colors is a first-party Palantir package in the same @blueprintjs scope; adding intra-org deps is expected and not a supply chain risk for this package. | ai | |
| provenance | no-provenance | AI (provenance): @blueprintjs/select is a long-established Palantir package; lack of Sigstore provenance is a process gap, not a security signal for this publisher. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Palantir's blueprint monorepo sub-packages can have long gaps between releases; dormancy is expected for stable components and does not indicate account takeover for this well-established publisher. | ai | |
| provenance | publisher-changed | AI (provenance): CircleCI CI/CD publisher for established Palantir package; benign automation, stable across versions. | ai | |
| phantom-deps | phantom-dep:@blueprintjs/colors | AI (phantom-deps): @blueprintjs/colors is a same-org dep used in CSS/SCSS compilation in this monorepo package; not a security concern and stable across versions. | ai |
Versions (showing 51 of 85)
| Version | Deps | Published |
|---|---|---|
| 6.3.3 | 5 / 12 | |
| 6.3.2 | 5 / 12 | |
| 6.3.1 | 5 / 12 | |
| 6.1.9 | 5 / 12 | |
| 6.1.8 | 5 / 12 | |
| 6.1.7 | 5 / 12 | |
| 6.1.6 | 5 / 11 | |
| 6.1.5 | 5 / 11 | |
| 6.1.4 | 5 / 14 | |
| 6.1.3 | 5 / 14 | |
| 6.1.2 | 5 / 14 | |
| 6.1.1 | 5 / 14 | |
| 6.1.0 | 5 / 14 | |
| 6.0.14 | 5 / 14 | |
| 6.0.13 | 5 / 14 | |
| 6.0.12 | 5 / 14 | |
| 6.0.11 | 5 / 14 | |
| 6.0.10 | 5 / 14 | |
| 6.0.9 | 5 / 14 | |
| 6.0.8 | 5 / 14 | |
| 6.0.6 | 4 / 11 | |
| 6.0.5 | 4 / 11 | |
| 6.0.4 | 4 / 11 | |
| 6.0.3 | 4 / 11 | |
| 6.0.2 | 4 / 11 | |
| 6.0.1 | 4 / 11 | |
| 6.0.0 | 4 / 11 | |
| 5.3.21 | 4 / 11 | |
| 5.3.20 | 4 / 11 | |
| 5.3.19 | 4 / 11 | |
| 5.3.18 | 4 / 11 | |
| 5.3.17 | 4 / 11 | |
| 5.3.16 | 4 / 11 | |
| 5.3.15 | 4 / 11 | |
| 5.3.14 | 4 / 11 | |
| 5.3.13 | 4 / 11 | |
| 5.3.12 | 4 / 11 | |
| 5.3.11 | 4 / 11 | |
| 5.3.10 | 4 / 11 | |
| 5.3.9 | 4 / 11 | |
| 5.3.8 | 4 / 11 | |
| 5.3.7 | 4 / 11 | |
| 5.3.6 | 4 / 11 | |
| 5.3.5 | 4 / 11 | |
| 5.3.4 | 4 / 11 | |
| 5.3.3 | 4 / 11 | |
| 5.3.2 | 4 / 11 | |
| 5.3.1 | 4 / 11 | |
| 5.3.0 | 4 / 11 | |
| 5.2.5 | 4 / 11 | |
| 5.2.4 | 4 / 11 |
v6.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.2
2 findings[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed from blueprintjs to an unknown CircleCI account with no history, combined with 405-day dormancy — strong account-takeover signal that generalizes until publisher ide) This version was published by a different npm account than previous versions on 2026-07-06. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.1
2 findings[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed from blueprintjs to an unknown CircleCI account with no history, combined with 405-day dormancy — strong account-takeover signal that generalizes until publisher ide) This version was published by a different npm account than previous versions on 2026-06-30. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.12
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: blueprintjs.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.