@instantdb/react-common

Instant DB shared components for React and React Native

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

stopachkanezajdwwdrew-h

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Publisher changed from personal account to GitHub Actions CI/CD with SLSA provenance attestation — this is a legitimate and security-improving transition for this established package.	ai	2026/04/26
maintainer-change	maintainer-removed	AI (maintainer-change): Maintainer removal is consistent with the transition to CI/CD publishing; SLSA attestation confirms releases originate from the official instantdb/instant repo.	ai	2026/04/26
bogus-package	bogus-package	AI (bogus-package): Monorepo sub-package with SLSA provenance, 69.5k weekly downloads, and official GitHub repo. README linking to main project docs is expected; no-keywords is minor. Not spam.	ai	2026/04/25
dependencies	unvetted-dep:@instantdb/core	AI (dependencies): Sibling package in the same instantdb/instant monorepo, pinned to the same version. Dependency is expected and legitimate.	ai	2026/04/25

View all versions

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.