@dxos/react-input — Greenflagged

Input primitive components for React.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

richburdonmarik_dwittjosiahdxos-botmykola-vrmchkyarolegovich

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
bogus-package	bogus-package	AI (bogus-package): Part of large DXOS monorepo; sparse README/keywords are consistent across all their packages.	ai	2026/05/29
provenance	no-provenance	AI (provenance): DXOS bot-published monorepo packages consistently lack provenance; stable pattern across versions.	ai	2026/05/29
phantom-deps	phantom-dep:lodash.omit	AI (phantom-deps): Declared as runtime dep; phantom-dep heuristic likely a false positive for this build setup.	ai	2026/05/29
phantom-deps	phantom-dep:@radix-ui/react-compose-refs	AI (phantom-deps): Radix UI dep declared in package.json; phantom-dep heuristic false positive for bundled output.	ai	2026/05/29
phantom-deps	phantom-dep:@radix-ui/react-use-controllable-state	AI (phantom-deps): Radix UI dep declared in package.json; phantom-dep heuristic false positive for bundled output.	ai	2026/05/29

Versions (showing 2 of 2)

Version	Deps	Published
0.8.3	9 / 4	2025-07-03
0.8.2	9 / 4	2025-06-17

v0.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.