@c-rex/ui No license 15 versions

@c-rex/ui

npm

This package contains UI components that are downloaded from [shadcn/ui](https://ui.shadcn.com/).

15

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

mwiedenmaierperiottocosta

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): All added deps are established Radix UI packages and tw-animate-css, matching new component exports in package.json.	ai	2026/05/11
dependencies	unvetted-dep:@radix-ui/react-avatar	AI (dependencies): Standard Radix UI primitive; consistent with the rest of the Radix deps in this UI library.	ai	2026/05/05
typosquat	typosquat.levenshtein:qs	AI (typosquat): Scoped UI library; no functional or naming resemblance to qs.	ai	2026/04/29
typosquat	typosquat.levenshtein:joi	AI (typosquat): Scoped UI library; no functional or naming resemblance to joi.	ai	2026/04/29
typosquat	typosquat.levenshtein:yup	AI (typosquat): Scoped UI library; no functional or naming resemblance to yup.	ai	2026/04/29
phantom-deps	phantom-dep:clsx	AI (phantom-deps): clsx is a declared dep used in config/build tooling; phantom-dep heuristic false positive for this package.	ai	2026/04/29
typosquat	typosquat.levenshtein:uuid	AI (typosquat): Scoped UI library; name collision is purely coincidental Levenshtein distance.	ai	2026/04/29
phantom-deps	phantom-dep:react-dom	AI (phantom-deps): react-dom is a peer dep declared in dependencies; phantom-dep heuristic false positive.	ai	2026/04/29
phantom-deps	phantom-dep:tailwind-merge	AI (phantom-deps): tailwind-merge is a declared dep used in config; phantom-dep heuristic false positive.	ai	2026/04/29
phantom-deps	phantom-dep:tw-animate-css	AI (phantom-deps): tw-animate-css is a declared dep; phantom-dep heuristic false positive for CSS-only package.	ai	2026/04/29
phantom-deps	phantom-dep:radix-ui	AI (phantom-deps): radix-ui is a declared dep; referenced in config files is expected for this UI library.	ai	2026/04/29
typosquat	typosquat.levenshtein:pg	AI (typosquat): Scoped UI library; no functional or naming resemblance to pg.	ai	2026/04/29

Versions (showing 15 of 15)

Version	Deps	Published
0.1.20	30 / 9	2026-02-26
0.1.19	30 / 9	2026-02-24
0.1.17	29 / 9	2026-02-16
0.1.14	28 / 9	2025-12-03
0.1.13	28 / 9	2025-11-21
0.1.12	28 / 9	2025-11-08
0.1.11	28 / 9	2025-11-01
0.1.4	26 / 9	2025-07-26
0.1.1	18 / 9	2025-06-03
0.1.0	18 / 9	2025-05-27
0.0.13	13 / 9	2025-05-10
0.0.12	13 / 9	2025-04-29
0.0.11	13 / 10	2025-04-28
0.0.10	13 / 9	2025-04-28
0.0.9	13 / 9	2025-04-28

v0.1.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.