@eui/deps-base
eUI base default dependencies
27
Versions
EUPL-1.1
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ec.europa.euirambou
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@eui/eds | AI (dependencies): Same-org sibling package at matching version, not a third-party dep. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): Aggregator package declares deps by design; none are directly imported. | ai | |
| dependencies | unvetted-dep:@eui/tools | AI (dependencies): same-org sibling package, not third-party | ai | |
| phantom-deps | phantom-dep:@eui/tools | AI (phantom-deps): same-org scoped package, expected in deps-base manifest | ai | |
| phantom-deps | phantom-dep:karma | AI (phantom-deps): deps-base package intentionally declares tooling deps without importing them | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Version-pin package for a toolkit; new deps are well-known tooling additions. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): Deps-base package intentionally declares versions without importing them. | ai | |
| phantom-deps | phantom-dep:ng-packagr | AI (phantom-deps): Build tool referenced in config; stable for Angular deps-base. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Build-time dependency referenced in config; stable for deps-base. | ai | |
| phantom-deps | phantom-dep:vitest | AI (phantom-deps): Config-referenced test framework; stable for deps-base packages. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Deps-base package; phantom deps are expected and benign for shared manifests. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Deps-base package; phantom deps are expected and benign for shared manifests. | ai | |
| phantom-deps | phantom-dep:jsdom | AI (phantom-deps): Deps-base package; phantom deps are expected and benign for shared manifests. | ai | |
| dependencies | unvetted-dep:angular-eslint | AI (dependencies): Official Angular ESLint tooling. | ai | |
| dependencies | unvetted-dep:quill | AI (dependencies): Legitimate rich text editor; standard dependency for Angular UI frameworks. | ai | |
| dependencies | unvetted-dep:xhr-mock | AI (dependencies): Standard HTTP mocking library for testing. | ai | |
| dependencies | unvetted-dep:ng-packagr | AI (dependencies): Official Angular library packaging tool. | ai | |
| dependencies | unvetted-dep:classlist.js | AI (dependencies): Well-known DOM polyfill; stable package. | ai | |
| dependencies | unvetted-dep:ngx-markdown | AI (dependencies): Popular Angular markdown rendering library. | ai | |
| dependencies | unvetted-dep:@angular/elements | AI (dependencies): Official Angular package from Google. | ai | |
| dependencies | unvetted-dep:@compodoc/compodoc | AI (dependencies): Standard Angular documentation generator. | ai | |
| dependencies | unvetted-dep:@duetds/date-picker | AI (dependencies): Legitimate web component date picker library. | ai | |
| dependencies | unvetted-dep:@webcomponents/custom-elements | AI (dependencies): Standard web components polyfill. | ai | |
| dependencies | unvetted-dep:@angular/material-moment-adapter | AI (dependencies): Official Angular Material adapter package. | ai | |
| provenance | no-provenance | AI (provenance): Established EU institutional package; provenance absence is consistent across all 3308 versions. | ai | |
| phantom-deps | phantom-dep:@eui/styles | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:@eui/components | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:@eui/showcase | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:@eui/core | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:@eui/base | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:@eui/ecl | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:@eui/cli | AI (phantom-deps): Dependency aggregator pattern; same org scope. | ai | |
| phantom-deps | phantom-dep:ngx-mask | AI (phantom-deps): Dependency aggregator pattern. | ai | |
| phantom-deps | phantom-dep:prismjs | AI (phantom-deps): Dependency aggregator pattern. | ai | |
| phantom-deps | phantom-dep:quill | AI (phantom-deps): Dependency aggregator pattern. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Dependency aggregator pattern; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:intl | AI (phantom-deps): Deps-base is a dependency aggregator; all phantom-dep findings are expected for this package type. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 21.4.0 | 83 / 0 | |
| 21.3.3 | 82 / 0 | |
| 21.3.2 | 82 / 0 | |
| 21.3.1 | 82 / 0 | |
| 21.3.0 | 82 / 0 | |
| 21.2.5 | 80 / 0 | |
| 21.2.4 | 80 / 0 | |
| 21.2.3 | 80 / 0 | |
| 21.2.2 | 80 / 0 | |
| 21.2.1 | 80 / 0 | |
| 21.2.0 | 80 / 0 | |
| 21.1.1 | 79 / 0 | |
| 21.1.0 | 79 / 0 | |
| 21.0.4 | 79 / 0 | |
| 21.0.3 | 79 / 0 | |
| 21.0.2 | 79 / 0 | |
| 21.0.1 | 79 / 0 | |
| 19.3.17 | 91 / 0 | |
| 19.3.16 | 91 / 0 | |
| 19.3.15 | 91 / 0 | |
| 19.3.14 | 91 / 0 | |
| 19.3.13 | 91 / 0 | |
| 19.3.12 | 91 / 0 | |
| 19.3.11 | 91 / 0 | |
| 19.3.10 | 91 / 0 | |
| 19.3.9 | 91 / 0 | |
| 19.3.8 | 91 / 0 |
v21.4.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.3.3
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.3.2
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.3.1
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.5
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v19.3.17
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v19.3.11
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.