@inkeep/agents-ui
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): altcha replaces altcha-lib (same library, renamed); not an unrelated new dependency. | ai | |
| phantom-deps | phantom-dep:altcha-lib | AI (phantom-deps): Declared for config/re-export; stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/primitives/components/embedded-chat/file-upload-input.cjs | AI (source-diff): Standard CJS bundle output with readable imports; not obfuscated. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New file-upload feature adds expected component files across primitives/styled dirs. | ai | |
| source-diff | obfuscated-file:dist/styled/components/embedded-chat/file-upload-input.cjs | AI (source-diff): Standard CJS bundle output with readable imports; not obfuscated. | ai | |
| phantom-deps | phantom-dep:lucide-react | AI (phantom-deps): Icon library likely re-exported via bundled dist; false positive for this package. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): React UI library declaring react as peer/dep without direct import is standard pattern. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Same as react — standard peer dep pattern for UI libraries. | ai | |
| phantom-deps | phantom-dep:@inkeep/cxkit-react | AI (phantom-deps): Same-org dep consumed via bundled dist output; phantom-dep is a false positive here. | ai | |
| phantom-deps | phantom-dep:@inkeep/cxkit-react-oss | AI (phantom-deps): Same-org dep consumed via bundled dist output; phantom-dep is a false positive here. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-avatar | AI (dependencies): Radix UI is a well-known, widely-used UI component library; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-popper | AI (dependencies): Radix UI is a well-known, widely-used UI component library; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-hover-card | AI (dependencies): Radix UI is a well-known, widely-used UI component library; stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Active UI library with 207 versions; sparse README/metadata is a style choice, not spam. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established package with many versions; missing description is cosmetic. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): UI library with peer/config-level usage; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/ui-utils | AI (phantom-deps): AI SDK integration; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@ai-sdk/openai | AI (phantom-deps): AI SDK integration; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:openai | AI (phantom-deps): AI SDK integration declared as dep but used via re-exports/config; stable FP. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-hover-card | AI (phantom-deps): Radix UI component dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:use-sync-external-store | AI (phantom-deps): React compat shim; stable false positive for this package. | ai |
Versions (showing 42 of 42)
| Version | Deps | Published |
|---|---|---|
| 0.17.0 | 59 / 25 | |
| 0.16.5 | 59 / 25 | |
| 0.16.4 | 59 / 25 | |
| 0.16.3 | 59 / 25 | |
| 0.16.2 | 59 / 25 | |
| 0.16.1 | 59 / 25 | |
| 0.16.0 | 59 / 25 | |
| 0.15.30 | 59 / 25 | |
| 0.15.28 | 59 / 25 | |
| 0.15.27 | 59 / 25 | |
| 0.15.26 | 58 / 25 | |
| 0.15.25 | 58 / 25 | |
| 0.15.24 | 58 / 25 | |
| 0.15.21 | 58 / 25 | |
| 0.15.16 | 58 / 25 | |
| 0.15.15 | 58 / 25 | |
| 0.15.14 | 58 / 25 | |
| 0.15.13 | 58 / 25 | |
| 0.15.11 | 57 / 25 | |
| 0.15.10 | 57 / 25 | |
| 0.15.9 | 57 / 25 | |
| 0.15.8 | 58 / 25 | |
| 0.15.7 | 58 / 25 | |
| 0.15.6 | 58 / 25 | |
| 0.15.5 | 58 / 25 | |
| 0.15.4 | 58 / 25 | |
| 0.15.3 | 58 / 25 | |
| 0.15.1 | 58 / 25 | |
| 0.15.0 | 58 / 25 | |
| 0.14.27 | 58 / 25 | |
| 0.14.25 | 58 / 25 | |
| 0.14.23 | 58 / 25 | |
| 0.14.22 | 58 / 25 | |
| 0.14.18 | 58 / 25 | |
| 0.14.17 | 58 / 25 | |
| 0.14.16 | 58 / 25 | |
| 0.14.14 | 58 / 25 | |
| 0.14.11 | 57 / 25 | |
| 0.14.10 | 57 / 25 | |
| 0.14.9 | 57 / 25 | |
| 0.14.8 | 57 / 25 | |
| 0.1.0 | 5 / 12 |
v0.17.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.16.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.0
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.30
4 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.15.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.