@boostxyz/boost-ui
## Best Practice
33
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
moimikeyccashwelljamieboostquaziasammccord
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/components/Avatar/Avatar.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Dialog/Dialog.js | AI (source-diff): Standard tsup minified ESM build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Skeleton/BaseSkeleton.js | AI (source-diff): Standard tsup minified ESM build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Dialog/BaseDialog.js | AI (source-diff): Standard tsup minified ESM build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Avatar/BaseAvatar.js | AI (source-diff): Standard tsup minified ESM build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Avatar/Avatar.js | AI (source-diff): Standard tsup minified ESM build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Skeleton/Skeleton.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Skeleton/index.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Dialog/index.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Avatar/index.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Dialog/Dialog.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Skeleton/BaseSkeleton.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Dialog/BaseDialog.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Avatar/BaseAvatar.cjs | AI (source-diff): Standard tsup minified build output for Radix UI component. | ai | |
| source-diff | obfuscated-file:dist/components/Accordion/BaseAccordion.cjs | AI (source-diff): Standard tsup minified bundle output for a React UI component; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/Accordion/index.js | AI (source-diff): Standard tsup minified bundle output for a React UI component; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/Accordion/BaseAccordion.js | AI (source-diff): Standard tsup minified bundle output for a React UI component; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/Accordion/Accordion.js | AI (source-diff): Standard tsup minified bundle output for a React UI component; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/Accordion/index.cjs | AI (source-diff): Standard tsup minified bundle output for a React UI component; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/Accordion/Accordion.cjs | AI (source-diff): Standard tsup minified bundle output for a React UI component; no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/IconOrAvatar/IconOrAvatar.cjs | AI (source-diff): Standard tsup minified build output; imports only @radix-ui/react-avatar and react, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/IconOrAvatar/index.js | AI (source-diff): Standard tsup minified ESM build output; imports only @radix-ui/react-avatar and react, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/IconOrAvatar/IconOrAvatar.js | AI (source-diff): Standard tsup minified ESM build output; imports only @radix-ui/react-avatar and react, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/IconOrAvatar/BaseIconOrAvatar.js | AI (source-diff): Standard tsup minified ESM build output; imports only @radix-ui/react-avatar and react, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/IconOrAvatar/index.cjs | AI (source-diff): Standard tsup minified build output; imports only @radix-ui/react-avatar and react, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/components/IconOrAvatar/BaseIconOrAvatar.cjs | AI (source-diff): Standard tsup minified build output; imports only @radix-ui/react-avatar and react, no malicious patterns. | ai | |
| provenance | publisher-changed | AI (provenance): jamieboost is an established publisher (54 approved/0 rejected) within the boostxyz org; transition from moimikey appears to be a legitimate organizational maintainer handoff. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): vaul is a well-known legitimate React drawer library by emilkowalski; adding it to a UI component library is expected and benign. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): jamieboost added within the @boostxyz org by a publisher with clean track record; routine team expansion for an established UI library. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop from 4MB to 266KB reflects removal of bloated artifacts/bundled output; consistent with package restructuring, not code replacement. | ai | |
| source-diff | large-new-source-files | AI (source-diff): UI component library using shadcn pattern; adding many component files is expected as the library grows. | ai | |
| dependencies | unvetted-dep:class-variance-authority | AI (dependencies): class-variance-authority (CVA) is a widely-used library for component variant management. Standard dependency for shadcn/ui-style component libraries. | ai | |
| dependencies | unvetted-dep:tailwindcss-animate | AI (dependencies): tailwindcss-animate is a common Tailwind CSS animation plugin. Expected dependency for a Tailwind-based UI library. | ai | |
| dependencies | unvetted-dep:tailwind-merge | AI (dependencies): tailwind-merge is a well-known, widely-used utility for merging Tailwind CSS classes. Stable false positive for this UI library package. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-avatar | AI (phantom-deps): Radix UI components may be referenced in config/barrel files without direct imports in every source file. Normal pattern for a component library. | ai | |
| phantom-deps | phantom-dep:tailwindcss-animate | AI (phantom-deps): Tailwind plugins are referenced in config files (tailwind.config.ts) rather than direct JS imports — this is the expected usage pattern for Tailwind plugins. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-progress | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-tooltip | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-toggle | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-switch | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-select | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-dialog | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-avatar | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@tanstack/react-table | AI (dependencies): TanStack Table is a widely-used, well-maintained React table library with no known security issues. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-icons | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-tabs | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:sonner | AI (dependencies): sonner is a legitimate, popular React toast notification library. Not a security risk for this UI package. | ai | |
| dependencies | unvetted-dep:vaul | AI (dependencies): vaul is a legitimate, widely-used React drawer component library. Not a security risk for this UI package. | ai | |
| provenance | no-provenance | AI (provenance): Lack of provenance is common (~88% of npm packages); no other risk signals present to elevate this concern. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-switch | AI (phantom-deps): Declared as a dependency and referenced in config files; common pattern in UI libraries. Not a security concern. | ai | |
| phantom-deps | phantom-dep:@tanstack/react-table | AI (phantom-deps): Declared as a dependency and referenced in config files; common pattern in UI libraries. Not a security concern. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-dropdown-menu | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-toggle-group | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-separator | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-accordion | AI (dependencies): Part of the well-known @radix-ui primitive library used extensively in React UI development. | ai |
Versions (showing 33 of 33)
| Version | Deps | Published |
|---|---|---|
| 0.15.1 | 19 / 19 | |
| 0.15.0 | 19 / 19 | |
| 0.14.0 | 19 / 19 | |
| 0.13.2 | 19 / 19 | |
| 0.13.1 | 19 / 19 | |
| 0.13.0 | 19 / 19 | |
| 0.12.1 | 19 / 19 | |
| 0.12.0 | 19 / 19 | |
| 0.11.2 | 19 / 19 | |
| 0.11.1 | 19 / 19 | |
| 0.11.0 | 19 / 19 | |
| 0.10.3 | 18 / 19 | |
| 0.10.2 | 18 / 19 | |
| 0.10.1 | 18 / 19 | |
| 0.9.2 | 18 / 19 | |
| 0.9.1 | 18 / 19 | |
| 0.9.0 | 18 / 19 | |
| 0.8.0 | 18 / 19 | |
| 0.7.0 | 18 / 19 | |
| 0.6.0 | 18 / 19 | |
| 0.5.3 | 17 / 19 | |
| 0.5.2 | 17 / 19 | |
| 0.5.1 | 17 / 19 | |
| 0.4.0 | 15 / 19 | |
| 0.2.6 | 14 / 19 | |
| 0.2.5 | 14 / 19 | |
| 0.2.4 | 14 / 19 | |
| 0.2.3 | 13 / 19 | |
| 0.2.2 | 12 / 19 | |
| 0.2.1 | 12 / 19 | |
| 0.2.0 | 12 / 19 | |
| 0.1.1 | 12 / 19 | |
| 0.1.0 | 16 / 15 |