@inkeep/agents-ui
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): No CI provenance yet, but not a malicious signal for this trusted publisher. | ai | |
| provenance | missing-githead | AI (provenance): Manual publish by known maintainer, no behavioral risk. | ai | |
| source-diff | obfuscated-file:dist/styled/components/embedded-chat.d.ts | AI (source-diff): Long-line .d.ts type declarations from vite-plugin-dts bundling, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/primitives/components/embedded-search.d.ts | AI (source-diff): Long-line .d.ts type declarations from vite-plugin-dts bundling, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/styled/components/embedded-search.d.ts | AI (source-diff): Long-line .d.ts type declarations from vite-plugin-dts bundling, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/primitives/components/embedded-chat.d.ts | AI (source-diff): Long-line .d.ts type declarations from vite-plugin-dts bundling, not obfuscation. | ai | |
| provenance | publisher-changed | AI (provenance): Change is to GitHub Actions CI publisher, an improvement not a compromise indicator. | ai | |
| vendored-integrity | unresolved-vendored-tree:dist/node_modules/.pnpm | AI (vendored-integrity): Stray pnpm build artifact, not an unexplained implant; consistent with dist build output. | ai | |
| vendored-integrity | unresolved-vendored-tree:dist/node_modules/.pnpm/[email protected][email protected]/node_modules/use-sync-external-store | AI (vendored-integrity): Known dependency vendored via pnpm build, matches declared dep. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): altcha replaces altcha-lib (same library, renamed); not an unrelated new dependency. | ai | |
| phantom-deps | phantom-dep:altcha-lib | AI (phantom-deps): Declared for config/re-export; stable pattern for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New file-upload feature adds expected component files across primitives/styled dirs. | ai | |
| source-diff | obfuscated-file:dist/primitives/components/embedded-chat/file-upload-input.cjs | AI (source-diff): Standard CJS bundle output with readable imports; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/styled/components/embedded-chat/file-upload-input.cjs | AI (source-diff): Standard CJS bundle output with readable imports; not obfuscated. | ai | |
| phantom-deps | phantom-dep:lucide-react | AI (phantom-deps): Icon library likely re-exported via bundled dist; false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Same as react — standard peer dep pattern for UI libraries. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): React UI library declaring react as peer/dep without direct import is standard pattern. | ai | |
| phantom-deps | phantom-dep:@inkeep/cxkit-react-oss | AI (phantom-deps): Same-org dep consumed via bundled dist output; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:@inkeep/cxkit-react | AI (phantom-deps): Same-org dep consumed via bundled dist output; phantom-dep is a false positive here. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-hover-card | AI (dependencies): Radix UI is a well-known, widely-used UI component library; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-avatar | AI (dependencies): Radix UI is a well-known, widely-used UI component library; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-popper | AI (dependencies): Radix UI is a well-known, widely-used UI component library; stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Active UI library with 207 versions; sparse README/metadata is a style choice, not spam. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established package with many versions; missing description is cosmetic. | ai | |
| phantom-deps | phantom-dep:use-sync-external-store | AI (phantom-deps): React compat shim; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/ui-utils | AI (phantom-deps): AI SDK integration; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/openai | AI (phantom-deps): AI SDK integration; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): UI library with peer/config-level usage; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:openai | AI (phantom-deps): AI SDK integration declared as dep but used via re-exports/config; stable FP. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-hover-card | AI (phantom-deps): Radix UI component dep; stable false positive for this package. | ai |
Versions (showing 51 of 67)
| Version | Deps | Published |
|---|---|---|
| 0.17.7 | 59 / 25 | |
| 0.17.6 | 59 / 25 | |
| 0.17.5 | 59 / 25 | |
| 0.17.4 | 59 / 25 | |
| 0.17.3 | 59 / 25 | |
| 0.17.2 | 59 / 25 | |
| 0.17.1 | 59 / 25 | |
| 0.17.0 | 59 / 25 | |
| 0.16.5 | 59 / 25 | |
| 0.16.4 | 59 / 25 | |
| 0.16.3 | 59 / 25 | |
| 0.16.2 | 59 / 25 | |
| 0.16.1 | 59 / 25 | |
| 0.16.0 | 59 / 25 | |
| 0.15.30 | 59 / 25 | |
| 0.15.29 | 59 / 25 | |
| 0.15.28 | 59 / 25 | |
| 0.15.27 | 59 / 25 | |
| 0.15.26 | 58 / 25 | |
| 0.15.25 | 58 / 25 | |
| 0.15.24 | 58 / 25 | |
| 0.15.23 | 58 / 25 | |
| 0.15.22 | 58 / 25 | |
| 0.15.21 | 58 / 25 | |
| 0.15.20 | 58 / 25 | |
| 0.15.19 | 58 / 25 | |
| 0.15.18 | 58 / 25 | |
| 0.15.17 | 58 / 25 | |
| 0.15.16 | 58 / 25 | |
| 0.15.15 | 58 / 25 | |
| 0.15.14 | 58 / 25 | |
| 0.15.13 | 58 / 25 | |
| 0.15.12 | 57 / 25 | |
| 0.15.11 | 57 / 25 | |
| 0.15.10 | 57 / 25 | |
| 0.15.9 | 57 / 25 | |
| 0.15.8 | 58 / 25 | |
| 0.15.7 | 58 / 25 | |
| 0.15.6 | 58 / 25 | |
| 0.15.5 | 58 / 25 | |
| 0.15.4 | 58 / 25 | |
| 0.15.3 | 58 / 25 | |
| 0.15.2 | 58 / 25 | |
| 0.15.1 | 58 / 25 | |
| 0.15.0 | 58 / 25 | |
| 0.14.28 | 58 / 25 | |
| 0.14.27 | 58 / 25 | |
| 0.14.26 | 58 / 25 | |
| 0.14.25 | 58 / 25 | |
| 0.14.24 | 58 / 25 | |
| 0.14.23 | 58 / 25 |
v0.17.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.20
2 findingsThis version was published by a different npm account than previous versions on 2026-03-24. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.19
2 findingsThis version was published by a different npm account than previous versions on 2026-03-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.18
2 findingsThis version was published by a different npm account than previous versions on 2026-03-16. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.17
2 findingsThis version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.