@dxos/react-ui — Greenflagged

Low-level React components for DXOS, applying a theme to a core group of primitives

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

richburdonmarik_dwittjosiahdxos-botmykola-vrmchk

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/types/src/components/Lists/List.d.ts	AI (source-diff): Long-line .d.ts type union, not obfuscated code; readable TS declarations.	ai	2026/07/17
phantom-deps	phantom-dep:@radix-ui/react-popper	AI (phantom-deps): Radix peer dep used indirectly via other radix components; stable FP.	ai	2026/07/17
source-diff	obfuscated-file:dist/types/src/components/Lists/Treegrid.d.ts	AI (source-diff): Same false-positive pattern: minified-looking .d.ts type declarations.	ai	2026/07/17
phantom-deps	phantom-dep:@dxos/react-list	AI (phantom-deps): Same-org monorepo dep; phantom-dep heuristic unreliable for monorepo peer/re-export patterns.	ai	2026/07/03
dependencies	unvetted-dep:@dxos/i18n	AI (dependencies): Same-org monorepo dep pinned to matching version; consistent with coordinated DXOS releases.	ai	2026/07/03
dependencies	unvetted-dep:@radix-ui/react-popper	AI (dependencies): Well-known Radix UI primitive; stable ecosystem package, not a risk for this package.	ai	2026/07/03
phantom-deps	phantom-dep:@effect-atom/atom-react	AI (phantom-deps): Referenced in config files per finding; phantom-dep false positive for this package.	ai	2026/07/03
phantom-deps	phantom-dep:@radix-ui/react-scroll-area	AI (phantom-deps): Referenced in config files; phantom-dep false positive for this package.	ai	2026/07/03
phantom-deps	phantom-dep:@atlaskit/pragmatic-drag-and-drop-hitbox	AI (phantom-deps): Referenced in config files; phantom-dep false positive for this package.	ai	2026/07/03
maintainer-change	maintainer-removed	AI (maintainer-change): Consistent with org-level CI migration; SLSA attestation and monorepo context confirm legitimate transition.	ai	2026/06/16
provenance	publisher-changed	AI (provenance): dxos-bot → GitHub Actions is a CI/CD migration; SLSA provenance attestation confirms integrity.	ai	2026/06/16
phantom-deps	phantom-dep:@radix-ui/react-collapsible	AI (phantom-deps): Same pattern — declared for consumer use, referenced in config files. Stable false positive.	ai	2026/05/29
phantom-deps	phantom-dep:@radix-ui/react-switch	AI (phantom-deps): Same pattern — declared for consumer use, referenced in config files. Stable false positive.	ai	2026/05/29
phantom-deps	phantom-dep:@radix-ui/react-avatar	AI (phantom-deps): Declared as dep for consumers; referenced in config/re-exports, not a direct import. Stable false positive for this package.	ai	2026/05/29

Versions (showing 32 of 32)

Version	Deps	Published
0.10.0	56 / 14	2026-07-02
0.9.0	55 / 14	2026-06-15
0.8.3	47 / 12	2025-07-03
0.8.2	47 / 12	2025-06-17
0.8.1	46 / 12	2025-04-30
0.8.0	44 / 12	2025-03-15
0.7.4	43 / 12	2024-12-19
0.7.3	43 / 12	2024-12-16
0.7.2	43 / 12	2024-12-05
0.7.1	43 / 12	2024-11-26
0.7.0	43 / 12	2024-11-21
0.6.13	34 / 12	2024-10-22
0.6.12	34 / 12	2024-10-16
0.6.11	34 / 12	2024-09-23
0.6.10	34 / 12	2024-09-18
0.6.9	33 / 12	2024-09-06
0.6.8	33 / 12	2024-09-05
0.6.7	32 / 12	2024-08-26
0.6.6	32 / 12	2024-08-22
0.6.5	32 / 12	2024-08-12
0.6.4	31 / 12	2024-08-02
0.6.3	31 / 12	2024-07-26
0.6.2	31 / 12	2024-07-16
0.6.1	31 / 12	2024-07-11
0.6.0	31 / 12	2024-07-04
0.5.8	31 / 12	2024-06-14
0.5.7	31 / 12	2024-06-12
0.5.6	31 / 12	2024-06-11
0.5.5	31 / 12	2024-05-30
0.5.4	31 / 12	2024-05-29
0.5.3	31 / 13	2024-05-28
0.5.2	31 / 13	2024-05-17

v0.10.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.7

3 findings

HIGH New obfuscated file: dist/types/src/components/Lists/List.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/types/src/components/Lists/Treegrid.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.6

3 findings

HIGH New obfuscated file: dist/types/src/components/Lists/List.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/types/src/components/Lists/Treegrid.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.5

3 findings

HIGH New obfuscated file: dist/types/src/components/Lists/List.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/types/src/components/Lists/Treegrid.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.