@hh.ru/magritte-ui-accordion
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo UI component; missing metadata is expected for org-scoped packages. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Consistent pattern across hh.ru monorepo packages; not a malice indicator. | ai | |
| phantom-deps | phantom-dep:@hh.ru/magritte-design-tokens | AI (phantom-deps): Same-org dep likely consumed transitively via CSS/tokens; stable false positive. | ai | |
| phantom-deps | phantom-dep:@hh.ru/magritte-ui-typography | AI (phantom-deps): Same-org dep; phantom-dep heuristic unreliable for CSS/type-only imports in monorepo. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 3.1.34 | 6 / 0 | |
| 3.1.13 | 5 / 0 | |
| 3.0.12 | 5 / 0 | |
| 3.0.11 | 5 / 0 | |
| 3.0.10 | 5 / 0 | |
| 3.0.9 | 5 / 0 |
v3.1.34
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.1.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.