@darajs/ui-causal-graph-editor
CausalGraph editor for the Dara UI framework
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Package transitioned to GitHub Actions CI publishing with SLSA attestation; consistent with org-wide CI/CD adoption. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Legitimate UI component library; sparse README/keywords are a style choice, not spam indicators. | ai | |
| dependencies | unvetted-dep:d3-dag | AI (dependencies): Legitimate D3 DAG layout library; stable dependency for a causal graph editor. | ai | |
| dependencies | unvetted-dep:vis-data | AI (dependencies): Legitimate vis.js data library; stable dependency for graph visualization. | ai | |
| phantom-deps | phantom-dep:graphology-layout-forceatlas2 | AI (phantom-deps): Graph layout lib consistent with package purpose; likely used indirectly via bundled output. | ai | |
| phantom-deps | phantom-dep:polished | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:vis-data | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:cytoscape | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:react-dnd | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:use-immer | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:graphology | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:vis-network | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:immer | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:svg-path-parser | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:@darajs/ui-icons | AI (phantom-deps): Same-org sibling package in causalens/dara monorepo. | ai | |
| phantom-deps | phantom-dep:@darajs/ui-utils | AI (phantom-deps): Same-org sibling package in causalens/dara monorepo. | ai | |
| phantom-deps | phantom-dep:fontfaceobserver | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:@darajs/ui-widgets | AI (phantom-deps): Same-org sibling package in causalens/dara monorepo. | ai | |
| phantom-deps | phantom-dep:react-dnd-html5-backend | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:graphology-layout-noverlap | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:graphology-dag | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:d3-dag | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:nanoid | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:comlink | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai | |
| phantom-deps | phantom-dep:d3-scale | AI (phantom-deps): Monorepo build artifact; deps referenced via bundler config, not direct imports. | ai |
Versions (showing 51 of 78)
| Version | Deps | Published |
|---|---|---|
| 1.29.4 | 31 / 33 | |
| 1.29.3 | 31 / 33 | |
| 1.29.0 | 31 / 38 | |
| 1.28.6 | 31 / 38 | |
| 1.28.5 | 31 / 38 | |
| 1.28.4 | 31 / 38 | |
| 1.28.3 | 31 / 38 | |
| 1.28.2 | 31 / 38 | |
| 1.28.1 | 31 / 38 | |
| 1.28.0 | 31 / 38 | |
| 1.27.1 | 31 / 38 | |
| 1.27.0 | 31 / 38 | |
| 1.26.13 | 31 / 38 | |
| 1.26.12 | 31 / 38 | |
| 1.26.11 | 31 / 39 | |
| 1.26.10 | 31 / 39 | |
| 1.26.9 | 31 / 39 | |
| 1.26.8 | 31 / 39 | |
| 1.26.7 | 31 / 39 | |
| 1.26.6 | 31 / 39 | |
| 1.26.5 | 31 / 39 | |
| 1.26.4 | 31 / 39 | |
| 1.26.3 | 31 / 39 | |
| 1.26.2 | 31 / 39 | |
| 1.26.1 | 31 / 39 | |
| 1.26.0 | 31 / 39 | |
| 1.25.6 | 31 / 39 | |
| 1.25.4 | 31 / 39 | |
| 1.25.3 | 31 / 39 | |
| 1.25.2 | 31 / 39 | |
| 1.25.1 | 31 / 39 | |
| 1.25.0 | 31 / 39 | |
| 1.24.3 | 31 / 39 | |
| 1.24.2 | 31 / 39 | |
| 1.24.1 | 31 / 39 | |
| 1.24.0 | 31 / 39 | |
| 1.23.1 | 31 / 39 | |
| 1.23.0 | 31 / 39 | |
| 1.22.4 | 31 / 39 | |
| 1.22.0 | 31 / 39 | |
| 1.21.25 | 31 / 39 | |
| 1.21.24 | 31 / 39 | |
| 1.21.23 | 31 / 39 | |
| 1.21.22 | 31 / 39 | |
| 1.21.21 | 31 / 39 | |
| 1.21.20 | 31 / 39 | |
| 1.21.19 | 31 / 39 | |
| 1.21.18 | 31 / 39 | |
| 1.21.17 | 31 / 39 | |
| 1.21.16 | 31 / 39 | |
| 1.21.15 | 31 / 39 |
v1.29.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.29.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.26.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.25.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.24.3
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (krzysztof-causalens) on 2026-01-14, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.24.2
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (krzysztof-causalens) on 2026-01-14, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.24.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.23.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.22.4
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (krzysztof-causalens) on 2025-12-01, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v1.22.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.