@gympass/yoga
Gympass component library
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:react-google-font-loader | AI (dependencies): Established utility dep used consistently across versions of this design system package. | ai | |
| dependencies | unvetted-dep:@gympass/yoga-common | AI (dependencies): Same-org monorepo sub-package; stable pattern across all versions of this package. | ai | |
| dependencies | unvetted-dep:@gympass/yoga-system | AI (dependencies): Same-org monorepo sub-package; stable pattern across all versions of this package. | ai | |
| dependencies | unvetted-dep:@gympass/yoga-tokens | AI (dependencies): Same-org monorepo sub-package; stable pattern across all versions of this package. | ai | |
| dependencies | unvetted-dep:@gympass/yoga-helpers | AI (dependencies): Same-org monorepo sub-package; stable pattern across all versions of this package. | ai | |
| dependencies | unvetted-dep:@gympass/yoga-illustrations | AI (dependencies): Same-org monorepo sub-package; stable pattern across all versions of this package. | ai | |
| source-diff | encoded-string-file:cjs/Input/web/data-images.js | AI (source-diff): Encoded strings are SVG icons and a flags sprite PNG via encodeURI(); standard pattern for this UI component library. | ai | |
| source-diff | encoded-string-file:esm/Input/web/data-images.js | AI (source-diff): Same as CJS counterpart — SVG/PNG assets encoded for inline use; not a malicious payload. | ai | |
| phantom-deps | phantom-dep:@gympass/yoga-illustrations | AI (phantom-deps): Same-org scoped package; phantom-dep heuristic unreliable for monorepo re-exports. | ai | |
| phantom-deps | phantom-dep:date-fns | AI (phantom-deps): date-fns is a declared runtime dep; may be used indirectly via re-exports or config files in this monorepo package. | ai | |
| typosquat | typosquat.levenshtein:koa | AI (typosquat): Scoped package @gympass/yoga is a well-known design system; Levenshtein match to 'koa' is a clear false positive. | ai |
v7.144.0
3 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.143.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.143.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.