@dr.pogodin/react-utils
Collection of generic ReactJS components and utils
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-exec | AI (semgrep): exec() in bin/build.js is part of the documented build CLI; not a runtime or install-time risk. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in the CLI build script (bin/build.js); expected for a build toolchain package. | ai | |
| source-diff | obfuscated-file:build/development/web.bundle.js | AI (source-diff): Standard webpack development bundle using eval devtool; explicitly documented in the file header. | ai | |
| source-diff | net-exec-file:build/development/web.bundle.js | AI (source-diff): eval() usage is webpack's eval devtool for source maps, not malicious code execution. | ai | |
| source-diff | net-exec-file:build/production/web.bundle.js | AI (source-diff): Network calls and dynamic code in webpack bundle are from bundled legitimate deps (axios, node-forge), not malware. | ai | |
| source-diff | obfuscated-file:build/production/web.bundle.js | AI (source-diff): Standard webpack production minified bundle; not obfuscation, just minification. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() used to parse server-injected data; commented with TODO for safer alternative, not malicious. | ai | |
| phantom-deps | phantom-dep:rimraf | AI (phantom-deps): Used in build scripts only, not imported at runtime; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@commander-js/extra-typings | AI (phantom-deps): TypeScript types package referenced in config, not a runtime import; stable false positive. | ai | |
| dependencies | unvetted-dep:@dr.pogodin/babel-plugin-react-css-modules | AI (dependencies): First-party package from same author. | ai | |
| dependencies | unvetted-dep:@dr.pogodin/csurf | AI (dependencies): First-party package from same author; consistent pattern across all versions. | ai | |
| dependencies | unvetted-dep:@dr.pogodin/js-utils | AI (dependencies): First-party package from same author. | ai | |
| dependencies | unvetted-dep:@dr.pogodin/react-helmet | AI (dependencies): First-party package from same author. | ai | |
| dependencies | unvetted-dep:@dr.pogodin/react-themes | AI (dependencies): First-party package from same author. | ai | |
| dependencies | unvetted-dep:@dr.pogodin/react-global-state | AI (dependencies): First-party package from same author. | ai | |
| typosquat | typosquat.pattern:react | AI (typosquat): Scoped package under author's own namespace; not impersonating react. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Framework-scoped package loaded by Babel transform convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:cross-env | AI (phantom-deps): cross-env is a declared runtime dep used in config/scripts, not directly imported in JS — stable false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads user-specified webpack config file; documented CLI build tool behavior. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread in build CLI script passing env to child process; standard build tool pattern, not a secret leak. | ai |
Versions (showing 91 of 91)
| Version | Deps | Published |
|---|---|---|
| 1.52.6 | 34 / 75 | |
| 1.52.5 | 34 / 75 | |
| 1.52.4 | 34 / 75 | |
| 1.52.3 | 34 / 75 | |
| 1.52.2 | 34 / 75 | |
| 1.52.1 | 34 / 75 | |
| 1.52.0 | 34 / 75 | |
| 1.51.4 | 34 / 75 | |
| 1.51.3 | 34 / 75 | |
| 1.51.2 | 35 / 75 | |
| 1.51.1 | 35 / 75 | |
| 1.51.0 | 35 / 75 | |
| 1.50.2 | 35 / 74 | |
| 1.50.1 | 35 / 74 | |
| 1.50.0 | 35 / 74 | |
| 1.49.1 | 34 / 74 | |
| 1.49.0 | 34 / 74 | |
| 1.48.20 | 34 / 74 | |
| 1.48.19 | 34 / 74 | |
| 1.48.18 | 34 / 74 | |
| 1.48.17 | 34 / 74 | |
| 1.48.16 | 34 / 74 | |
| 1.48.15 | 34 / 74 | |
| 1.48.14 | 34 / 74 | |
| 1.48.13 | 34 / 74 | |
| 1.48.12 | 34 / 74 | |
| 1.48.10 | 34 / 74 | |
| 1.48.9 | 34 / 74 | |
| 1.48.8 | 34 / 74 | |
| 1.48.7 | 34 / 74 | |
| 1.48.6 | 34 / 74 | |
| 1.48.5 | 34 / 74 | |
| 1.48.4 | 34 / 74 | |
| 1.48.3 | 34 / 74 | |
| 1.48.2 | 34 / 74 | |
| 1.48.1 | 34 / 74 | |
| 1.48.0 | 34 / 74 | |
| 1.47.5 | 34 / 74 | |
| 1.47.4 | 34 / 74 | |
| 1.47.3 | 34 / 74 | |
| 1.47.2 | 33 / 74 | |
| 1.47.1 | 33 / 74 | |
| 1.47.0 | 33 / 74 | |
| 1.46.4 | 34 / 74 | |
| 1.46.3 | 34 / 74 | |
| 1.46.2 | 34 / 74 | |
| 1.46.1 | 34 / 74 | |
| 1.46.0 | 34 / 74 | |
| 1.45.0 | 34 / 74 | |
| 1.44.10 | 34 / 74 | |
| 1.44.9 | 34 / 74 | |
| 1.44.8 | 34 / 74 | |
| 1.44.7 | 34 / 74 | |
| 1.44.6 | 34 / 74 | |
| 1.44.5 | 34 / 74 | |
| 1.44.4 | 34 / 74 | |
| 1.44.3 | 34 / 74 | |
| 1.44.2 | 34 / 74 | |
| 1.44.1 | 34 / 74 | |
| 1.44.0 | 34 / 74 | |
| 1.43.34 | 35 / 73 | |
| 1.43.33 | 35 / 73 | |
| 1.43.32 | 35 / 73 | |
| 1.43.31 | 35 / 73 | |
| 1.43.30 | 35 / 73 | |
| 1.43.29 | 35 / 73 | |
| 1.43.28 | 35 / 73 | |
| 1.43.27 | 35 / 73 | |
| 1.43.26 | 35 / 73 | |
| 1.43.25 | 35 / 73 | |
| 1.43.24 | 35 / 73 | |
| 1.43.23 | 35 / 73 | |
| 1.43.22 | 35 / 73 | |
| 1.43.21 | 35 / 73 | |
| 1.43.20 | 35 / 73 | |
| 1.43.19 | 35 / 73 | |
| 1.43.18 | 35 / 73 | |
| 1.43.17 | 35 / 73 | |
| 1.43.16 | 35 / 73 | |
| 1.43.15 | 35 / 73 | |
| 1.43.14 | 35 / 73 | |
| 1.43.13 | 35 / 73 | |
| 1.43.12 | 35 / 73 | |
| 1.43.11 | 35 / 73 | |
| 1.43.10 | 35 / 74 | |
| 1.43.9 | 35 / 74 | |
| 1.43.8 | 35 / 74 | |
| 1.43.7 | 35 / 74 | |
| 1.43.6 | 35 / 75 | |
| 1.43.5 | 35 / 75 | |
| 1.43.4 | 35 / 75 |
v1.52.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.52.0
3 findingsPackage name '@dr.pogodin/react-utils' matches a known typosquatting pattern (hyphen swap, prefix/suffix) of 'react'.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/birdofpreyru/react-utils/blob/c1d1f2167d4657a6fce77388df1aedbfb20114ca/bin/build.js#L239 237 | if (watch) command += ' --watch'; 238 | await exec(command, { > 239 | env: { 240 | ...process.env, 241 | BABEL_ENV: buildType
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.51.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.51.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.51.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.51.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.51.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.50.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.50.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.50.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.49.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.49.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.48.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.47.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.47.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.47.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.46.4
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.3
5 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.46.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.46.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.46.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.45.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.44.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.34
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.43.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.