← Home

@exadel/esl

npm Repository Homepage

Exadel Smart Library (ESL) is the lightweight custom elements library that provide a set of super-flexible components

2
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

ala-nyadamskaalesun

Keywords

esllightweighttypescriptflexibleweb componentsweb components utilscustom elementscustom elements tscomponent libraryanimateaccordiontabsembedded-videoscrollbar

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): SLSA provenance attestation confirms CI/CD publish; no material changes from prior version; established org package. ai
dependencies unvetted-dep:@types/youtube AI (dependencies): Type-only dependency for YouTube provider integration; no runtime risk. ai
dependencies unvetted-dep:@types/video.js AI (dependencies): Type-only dependency for video.js provider integration; no runtime risk. ai
phantom-deps phantom-dep:@types/youtube AI (phantom-deps): Type-only dep for optional YouTube provider integration; not directly imported but used by convention. ai
typosquat typosquat.levenshtein:jest AI (typosquat): Scoped package @exadel/esl cannot be a typosquat of jest; Levenshtein match is meaningless here. ai
phantom-deps phantom-dep:@types/video.js AI (phantom-deps): Type-only dep for optional video.js provider integration; not directly imported but used by convention. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped package @exadel/esl cannot be a typosquat of qs; Levenshtein match is meaningless here. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get used in a Proxy handler for parameter fallback — standard JS pattern, not obfuscation. ai

Versions (showing 2 of 2)

Version Deps Published
6.1.0 2 / 2
6.0.0 2 / 2

v6.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.