@crystaldesign/diva-backoffice
46
Versions
COMMERCIAL
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
crystaldesign
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): No material diff otherwise; consistent with normal monorepo build output growth. | ai | |
| phantom-deps | phantom-dep:@dnd-kit/utilities | AI (phantom-deps): Same as @dnd-kit/core — config-reference FP. | ai | |
| phantom-deps | phantom-dep:@dnd-kit/core | AI (phantom-deps): Newly added runtime dep; phantom-dep heuristic fires on config references; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Large UI library; lodash commonly used transitively or in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@dnd-kit/sortable | AI (phantom-deps): Same as @dnd-kit/core — config-reference FP. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @google/genai is Google's official GenAI SDK; legitimate feature addition for a backoffice UI library. | ai | |
| provenance | no-provenance | AI (provenance): Long-established publisher with consistent release cadence; no provenance is a known gap for this package family. | ai | |
| dependencies | unvetted-dep:@crystaldesign/spreadsheet | AI (dependencies): Internal crystaldesign ecosystem dep; consistent across all versions of this package. | ai | |
| dependencies | unvetted-dep:@crystaldesign/diva-core | AI (dependencies): Internal crystaldesign ecosystem dep; consistent across all versions of this package. | ai | |
| phantom-deps | phantom-dep:@crystaldesign/media-upload | AI (phantom-deps): Same-org sibling; likely re-exported or lazy-loaded. | ai | |
| phantom-deps | phantom-dep:react-infinite-scroll-component | AI (phantom-deps): Referenced in config; large UI lib with dynamic imports. | ai | |
| phantom-deps | phantom-dep:object-hash | AI (phantom-deps): Same as above — config-referenced dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Framework-scoped, loaded by convention; stable FP for this package. | ai | |
| phantom-deps | phantom-dep:react-org-tree | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:ag-charts-react | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:fast-json-patch | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:@ant-design/icons | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:react-collapsible | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:react-error-boundary | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:react-zoom-pan-pinch | AI (phantom-deps): Config-referenced dep, stable FP for this large UI library. | ai | |
| phantom-deps | phantom-dep:@crystaldesign/diva-utils | AI (phantom-deps): Same-org dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:@crystaldesign/rtf-editor | AI (phantom-deps): Same-org dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:@crystaldesign/content-box | AI (phantom-deps): Same-org dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:@crystaldesign/content-item | AI (phantom-deps): Same-org dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:fast-sort | AI (phantom-deps): Same as above — config-referenced dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:jsonpath | AI (phantom-deps): Same as above — config-referenced dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Same as above — config-referenced dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:flat | AI (phantom-deps): Same as above — config-referenced dep, stable FP for this package. | ai | |
| phantom-deps | phantom-dep:csv | AI (phantom-deps): Large UI library; deps referenced in config/re-exports, not direct imports. Stable FP pattern. | ai | |
| phantom-deps | phantom-dep:@google/model-viewer | AI (phantom-deps): Declared in package.json as runtime dep; phantom-dep heuristic false positive for config-referenced deps. | ai | |
| phantom-deps | phantom-dep:ag-charts-community | AI (phantom-deps): Declared in package.json as runtime dep; phantom-dep heuristic false positive for config-referenced deps. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable pattern for this private commercial package family. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Private commercial component library; missing metadata is consistent across all versions, not a malice indicator. | ai |
Versions (showing 46 of 46)
| Version | Deps | Published |
|---|---|---|
| 26.7.2 | 35 / 8 | |
| 26.7.0 | 35 / 8 | |
| 26.6.5 | 32 / 8 | |
| 26.6.4 | 32 / 8 | |
| 26.6.3 | 32 / 8 | |
| 26.6.2 | 32 / 8 | |
| 26.6.1 | 32 / 8 | |
| 26.6.0 | 32 / 8 | |
| 26.5.3 | 32 / 8 | |
| 26.5.2 | 32 / 8 | |
| 26.5.1 | 32 / 8 | |
| 26.5.0 | 32 / 8 | |
| 26.4.8 | 31 / 8 | |
| 26.4.7 | 31 / 8 | |
| 26.4.6 | 31 / 8 | |
| 26.4.5 | 31 / 8 | |
| 26.4.4 | 31 / 8 | |
| 26.4.3 | 31 / 8 | |
| 26.4.2 | 31 / 8 | |
| 26.4.1 | 31 / 8 | |
| 26.4.0 | 31 / 8 | |
| 26.3.2 | 30 / 8 | |
| 26.3.1 | 30 / 8 | |
| 26.3.0 | 30 / 8 | |
| 26.2.4 | 30 / 8 | |
| 26.2.3 | 30 / 8 | |
| 26.2.2 | 30 / 8 | |
| 26.2.1 | 30 / 8 | |
| 26.2.0 | 30 / 8 | |
| 26.1.2 | 30 / 8 | |
| 26.1.1 | 30 / 8 | |
| 26.1.0 | 30 / 8 | |
| 25.16.2 | 30 / 8 | |
| 25.16.1 | 30 / 8 | |
| 25.16.0 | 30 / 8 | |
| 25.14.4 | 30 / 8 | |
| 25.14.3 | 30 / 8 | |
| 25.14.2 | 30 / 8 | |
| 25.14.1 | 30 / 8 | |
| 25.14.0 | 30 / 8 | |
| 25.13.7 | 30 / 8 | |
| 25.13.6 | 30 / 8 | |
| 25.13.5 | 30 / 8 | |
| 25.13.4 | 30 / 8 | |
| 25.13.3 | 30 / 8 | |
| 25.13.2 | 30 / 8 |
v26.7.2
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v26.7.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.