@eqproject/eqp-datetimerangepicker
6
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
eqpa.cipollone
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): Publisher has 5 approved packages; this is a legitimate Angular 21 compatibility update after a dormancy period. | ai | |
| phantom-deps | phantom-dep:ngx-translate | AI (phantom-deps): ngx-translate is a security-placeholder package on npm; declared but not imported, stable false positive for this package. | ai | |
| dependencies | unvetted-dep:ngx-translate | AI (dependencies): [email protected] is an npm security placeholder package, not a functional dependency; real translation is via @ngx-translate/core. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a well-known Angular implicit runtime dep; stable false positive for Angular libraries. | ai | |
| phantom-deps | phantom-dep:@ngx-translate/http-loader | AI (phantom-deps): http-loader is a companion to @ngx-translate/core; config-only reference is standard Angular i18n setup. | ai | |
| phantom-deps | phantom-dep:bootstrap | AI (phantom-deps): Bootstrap referenced in config/styles for UI theming; not a direct import pattern for Angular libs. | ai | |
| phantom-deps | phantom-dep:@popperjs/core | AI (phantom-deps): Popper is a peer/indirect dep of Bootstrap; config-only reference is expected. | ai |