@decaf-ts/ui-decorators
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@decaf-ts/decoration | AI (phantom-deps): Same-org transitive dep; phantom-dep false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/ui-decorators.js | AI (source-diff): Standard minified ESM bundle with readable symbols; no encoding, eval, or network calls. Stable pattern for this package. | ai | |
| provenance | no-provenance | AI (provenance): Established package with long clean history; lack of Sigstore attestation is a process gap, not a security risk here. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Established decaf-ts org; maintainer addition appears to be a legitimate team expansion. | ai |
Versions (showing 51 of 85)
| Version | Deps | Published |
|---|---|---|
| 0.18.0 | 3 / 3 | |
| 0.17.11 | 3 / 3 | |
| 0.17.10 | 3 / 3 | |
| 0.17.9 | 3 / 3 | |
| 0.17.8 | 3 / 3 | |
| 0.17.7 | 3 / 3 | |
| 0.17.6 | 3 / 3 | |
| 0.17.5 | 3 / 3 | |
| 0.17.4 | 3 / 3 | |
| 0.17.3 | 3 / 3 | |
| 0.17.1 | 3 / 3 | |
| 0.17.0 | 3 / 3 | |
| 0.16.2 | 3 / 3 | |
| 0.16.1 | 3 / 3 | |
| 0.16.0 | 3 / 3 | |
| 0.15.0 | 3 / 3 | |
| 0.14.0 | 3 / 3 | |
| 0.13.0 | 3 / 3 | |
| 0.12.0 | 3 / 3 | |
| 0.11.0 | 3 / 3 | |
| 0.10.0 | 3 / 3 | |
| 0.9.0 | 3 / 3 | |
| 0.8.0 | 3 / 3 | |
| 0.7.7 | 3 / 3 | |
| 0.7.6 | 3 / 3 | |
| 0.7.5 | 3 / 3 | |
| 0.7.4 | 3 / 3 | |
| 0.7.3 | 3 / 3 | |
| 0.7.2 | 3 / 3 | |
| 0.7.1 | 3 / 3 | |
| 0.7.0 | 3 / 3 | |
| 0.6.20 | 3 / 3 | |
| 0.6.19 | 3 / 3 | |
| 0.6.18 | 3 / 3 | |
| 0.6.17 | 3 / 3 | |
| 0.6.16 | 3 / 2 | |
| 0.6.15 | 3 / 2 | |
| 0.6.14 | 3 / 2 | |
| 0.6.13 | 3 / 2 | |
| 0.6.11 | 3 / 2 | |
| 0.6.9 | 3 / 2 | |
| 0.6.8 | 5 / 2 | |
| 0.6.7 | 3 / 2 | |
| 0.6.6 | 3 / 2 | |
| 0.6.5 | 3 / 2 | |
| 0.6.4 | 3 / 2 | |
| 0.6.3 | 3 / 2 | |
| 0.6.1 | 3 / 2 | |
| 0.5.32 | 4 / 2 | |
| 0.5.31 | 4 / 2 | |
| 0.5.30 | 4 / 2 |
v0.18.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.10
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (tvenceslau) than the most recent previously approved version (demersoncarvalho) on 2026-07-07, but tvenceslau is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.17.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.7
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (demersoncarvalho) than the most recent previously approved version (tvenceslau) on 2026-07-07, but demersoncarvalho is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.17.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.4
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (tvenceslau) than the most recent previously approved version (demersoncarvalho) on 2026-06-30, but tvenceslau is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.