@djb25/digit-ui-module-commonpt
Digit PT Light weight Module
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@djb25/digit-ui-react-components | AI (dependencies): Sibling scoped package from the same publisher namespace (@djb25); expected dependency for a modular UI library in this ecosystem. | ai | |
| dependencies | unvetted-dep:microbundle-crl | AI (dependencies): microbundle-crl is a build tool used only in build scripts; not a runtime risk for consumers of this package. | ai | |
| dependencies | unvetted-dep:react-query | AI (dependencies): react-query is a well-known, widely-used data-fetching library; unvetted status reflects pipeline gap, not a real risk for this package. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common (~88% of npm packages); no other indicators of supply chain compromise for this package. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): react-dom is declared as a dependency and referenced in config/build files; not a security concern for this UI module package. | ai | |
| phantom-deps | phantom-dep:microbundle-crl | AI (phantom-deps): microbundle-crl is a build tool referenced in scripts/config; phantom-dep finding is expected for build tooling. | ai | |
| phantom-deps | phantom-dep:lodash.merge | AI (phantom-deps): lodash.merge declared but used via config; standard packaging pattern, no security risk. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 1.0.24 | 9 / 0 | |
| 1.0.23 | 9 / 0 | |
| 1.0.22 | 9 / 0 | |
| 1.0.21 | 9 / 0 | |
| 1.0.20 | 9 / 0 | |
| 1.0.19 | 9 / 0 | |
| 1.0.18 | 9 / 0 | |
| 1.0.17 | 9 / 0 | |
| 1.0.16 | 9 / 0 | |
| 1.0.15 | 9 / 0 | |
| 1.0.14 | 9 / 0 | |
| 1.0.13 | 9 / 0 | |
| 1.0.12 | 9 / 0 | |
| 1.0.11 | 9 / 0 | |
| 1.0.10 | 9 / 0 | |
| 1.0.9 | 9 / 0 | |
| 1.0.8 | 9 / 0 | |
| 1.0.7 | 9 / 0 | |
| 1.0.6 | 9 / 0 | |
| 1.0.5 | 9 / 0 | |
| 1.0.4 | 9 / 0 | |
| 1.0.3 | 9 / 0 | |
| 1.0.2 | 9 / 0 | |
| 1.0.1 | 9 / 0 | |
| 1.0.0 | 9 / 0 |
v1.0.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.