@codecademy/gamut-kit
Styleguide & Component library for Codecademy
100
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
codecademy-eng
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-takeover | AI (maintainer-change): Org account rename from codecademy to codecademy-eng; confirmed same maintainer by email match across 122 approved packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): codecademy-eng is the renamed org account, not a new external party. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): codecademy account removal is the other side of the org rename; same entity. | ai | |
| provenance | no-provenance | AI (provenance): Large org monorepo with long publish history; absence of Sigstore attestation is not a risk signal here. | ai | |
| dependencies | unvetted-dep:component-test-setup | AI (dependencies): component-test-setup is a test utility, also flagged as phantom (not directly imported); stable low-risk pattern for this package. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): High-frequency monorepo CI publishing pattern; 8939 versions published over 5+ years is consistent with automated pipelines. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut-patterns | AI (phantom-deps): Same-org aggregator pattern; stable false positive. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut | AI (phantom-deps): Kit package re-exports org deps; not directly imported by design. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal design system kit; sparse README and no keywords are expected for internal tooling packages. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut-illustrations | AI (phantom-deps): Same-org aggregator pattern; stable false positive. | ai | |
| phantom-deps | phantom-dep:@codecademy/variance | AI (phantom-deps): Same-org aggregator pattern; phantom-dep is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:component-test-setup | AI (phantom-deps): Referenced in config files per finding; not a real phantom dep. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut-icons | AI (phantom-deps): Same-org aggregator pattern; stable false positive. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut-tests | AI (phantom-deps): Same-org aggregator pattern; stable false positive. | ai | |
| phantom-deps | phantom-dep:@codecademy/gamut-styles | AI (phantom-deps): Same-org aggregator pattern; stable false positive. | ai |
Versions (showing 100 of 213)
| Version | Deps | Published |
|---|---|---|
| 3.0.10 | 8 / 0 | |
| 3.0.9 | 8 / 0 | |
| 3.0.8 | 8 / 0 | |
| 3.0.7 | 8 / 0 | |
| 3.0.6 | 8 / 0 | |
| 3.0.5 | 8 / 0 | |
| 3.0.4 | 8 / 0 | |
| 3.0.3 | 8 / 0 | |
| 3.0.2 | 8 / 0 | |
| 3.0.1 | 8 / 0 | |
| 3.0.0 | 8 / 0 | |
| 2.0.0 | 8 / 0 | |
| 1.0.0 | 8 / 0 | |
| 0.6.603 | 8 / 0 | |
| 0.6.602 | 8 / 0 | |
| 0.6.601 | 8 / 0 | |
| 0.6.600 | 8 / 0 | |
| 0.6.599 | 8 / 0 | |
| 0.6.598 | 8 / 0 | |
| 0.6.597 | 8 / 0 | |
| 0.6.596 | 8 / 0 | |
| 0.6.595 | 8 / 0 | |
| 0.6.594 | 8 / 0 | |
| 0.6.593 | 8 / 0 | |
| 0.6.592 | 8 / 0 | |
| 0.6.591 | 8 / 0 | |
| 0.6.590 | 8 / 0 | |
| 0.6.589 | 8 / 0 | |
| 0.6.588 | 8 / 0 | |
| 0.6.587 | 8 / 0 | |
| 0.6.586 | 8 / 0 | |
| 0.6.585 | 8 / 0 | |
| 0.6.584 | 8 / 0 | |
| 0.6.583 | 8 / 0 | |
| 0.6.582 | 8 / 0 | |
| 0.6.581 | 8 / 0 | |
| 0.6.580 | 8 / 0 | |
| 0.6.579 | 8 / 0 | |
| 0.6.578 | 8 / 0 | |
| 0.6.577 | 8 / 0 | |
| 0.6.576 | 8 / 0 | |
| 0.6.575 | 8 / 0 | |
| 0.6.574 | 8 / 0 | |
| 0.6.573 | 8 / 0 | |
| 0.6.572 | 8 / 0 | |
| 0.6.571 | 8 / 0 | |
| 0.6.570 | 8 / 0 | |
| 0.6.569 | 8 / 0 | |
| 0.6.568 | 8 / 0 | |
| 0.6.567 | 8 / 0 | |
| 0.6.566 | 8 / 0 | |
| 0.6.565 | 8 / 0 | |
| 0.6.564 | 8 / 0 | |
| 0.6.563 | 8 / 0 | |
| 0.6.562 | 8 / 0 | |
| 0.6.561 | 8 / 0 | |
| 0.6.560 | 8 / 0 | |
| 0.6.559 | 8 / 0 | |
| 0.6.558 | 8 / 0 | |
| 0.6.557 | 8 / 0 | |
| 0.6.556 | 8 / 0 | |
| 0.6.555 | 8 / 0 | |
| 0.6.554 | 8 / 0 | |
| 0.6.553 | 8 / 0 | |
| 0.6.552 | 8 / 0 | |
| 0.6.551 | 8 / 0 | |
| 0.6.550 | 8 / 0 | |
| 0.6.549 | 8 / 0 | |
| 0.6.548 | 8 / 0 | |
| 0.6.547 | 8 / 0 | |
| 0.6.546 | 8 / 0 | |
| 0.6.545 | 8 / 0 | |
| 0.6.544 | 8 / 0 | |
| 0.6.543 | 8 / 0 | |
| 0.6.542 | 8 / 0 | |
| 0.6.541 | 8 / 0 | |
| 0.6.540 | 8 / 0 | |
| 0.6.539 | 8 / 0 | |
| 0.6.538 | 8 / 0 | |
| 0.6.537 | 8 / 0 | |
| 0.6.536 | 8 / 0 | |
| 0.6.535 | 8 / 0 | |
| 0.6.534 | 8 / 0 | |
| 0.6.533 | 8 / 0 | |
| 0.6.532 | 8 / 0 | |
| 0.6.531 | 8 / 0 | |
| 0.6.530 | 8 / 0 | |
| 0.6.529 | 8 / 0 | |
| 0.6.528 | 8 / 0 | |
| 0.6.527 | 8 / 0 | |
| 0.6.526 | 8 / 0 | |
| 0.6.525 | 8 / 0 | |
| 0.6.524 | 8 / 0 | |
| 0.6.523 | 8 / 0 | |
| 0.6.522 | 8 / 0 | |
| 0.6.521 | 8 / 0 | |
| 0.6.520 | 8 / 0 | |
| 0.6.519 | 8 / 0 | |
| 0.6.518 | 8 / 0 | |
| 0.6.517 | 8 / 0 |
Showing 100 of 213
Next page →
v3.0.10
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.9
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.8
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.7
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.