@carbon-labs/wc-global-header
Carbon Labs - global-header component
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:es/HybridIpaasHeader-T48NCm_A.mjs | AI (source-diff): Standard Vite/Rollup minified bundle with Lit framework code; not obfuscated malware. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:es/components/global-header/src/index.scss.js | AI (source-diff): Minified CSS-in-JS build artifact (Lit css template); standard output for SCSS-compiled web component packages. | ai | |
| source-diff | obfuscated-file:lib/components/global-header/src/index.scss.js | AI (source-diff): Same minified CSS-in-JS build artifact in CJS format; not obfuscation. | ai | |
| phantom-deps | phantom-dep:@carbon/web-components | AI (phantom-deps): Config-referenced Carbon dependency; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Babel runtime is framework-scoped and loaded by convention; stable pattern for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Carbon Labs org package with legitimate GitHub repo; link-dump signal is false positive. | ai | |
| phantom-deps | phantom-dep:@lit-labs/motion | AI (phantom-deps): Config-referenced dependency; stable pattern for Lit-based component library. | ai | |
| phantom-deps | phantom-dep:@carbon-labs/utilities | AI (phantom-deps): Same-org scoped dependency; stable pattern for Carbon Labs monorepo. | ai |
Versions (showing 32 of 32)
| Version | Deps | Published |
|---|---|---|
| 0.74.0 | 4 / 6 | |
| 0.67.0 | 4 / 6 | |
| 0.65.0 | 4 / 6 | |
| 0.64.0 | 4 / 6 | |
| 0.63.0 | 4 / 6 | |
| 0.62.0 | 4 / 6 | |
| 0.61.0 | 4 / 6 | |
| 0.60.0 | 4 / 6 | |
| 0.59.0 | 4 / 6 | |
| 0.58.0 | 4 / 6 | |
| 0.57.0 | 4 / 6 | |
| 0.29.0 | 4 / 3 | |
| 0.28.0 | 4 / 3 | |
| 0.27.0 | 4 / 3 | |
| 0.26.0 | 4 / 3 | |
| 0.25.0 | 4 / 3 | |
| 0.24.0 | 4 / 3 | |
| 0.23.0 | 4 / 3 | |
| 0.22.0 | 4 / 3 | |
| 0.21.0 | 4 / 3 | |
| 0.20.0 | 4 / 3 | |
| 0.19.0 | 4 / 3 | |
| 0.11.0 | 4 / 2 | |
| 0.10.0 | 4 / 2 | |
| 0.8.0 | 4 / 2 | |
| 0.7.0 | 4 / 2 | |
| 0.6.0 | 4 / 2 | |
| 0.5.0 | 4 / 2 | |
| 0.4.0 | 4 / 0 | |
| 0.3.0 | 4 / 0 | |
| 0.2.0 | 4 / 0 | |
| 0.1.0 | 4 / 0 |
v0.74.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.67.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.65.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.64.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.63.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.62.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.61.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.60.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.59.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.58.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.57.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.29.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.28.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.27.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.26.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.25.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.22.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.21.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.11.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.