@khanacademy/wonder-blocks-search-field
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Khan Academy migrated publishing to GitHub Actions CI with SLSA attestation; this is a legitimate org-wide automation change. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): SLSA provenance confirms legitimate CI publish; dormancy reflects org cadence, not account takeover. | ai | |
| dependencies | unvetted-dep:@khanacademy/wonder-blocks-icon | AI (dependencies): Internal sibling dep from Khan Academy wonder-blocks monorepo; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@khanacademy/wonder-blocks-tokens | AI (dependencies): Internal sibling dep from Khan Academy wonder-blocks monorepo; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@khanacademy/wonder-blocks-core | AI (dependencies): Internal sibling dep from Khan Academy wonder-blocks monorepo; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@khanacademy/wonder-blocks-icon-button | AI (dependencies): Internal sibling dep from Khan Academy wonder-blocks monorepo; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@khanacademy/wonder-blocks-typography | AI (dependencies): Internal sibling dep from Khan Academy wonder-blocks monorepo; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:@khanacademy/wonder-blocks-form | AI (dependencies): Internal sibling dep from Khan Academy wonder-blocks monorepo; stable false positive for this package family. | ai |
Versions (showing 60 of 60)
| Version | Deps | Published |
|---|---|---|
| 5.1.72 | 6 / 1 | |
| 5.1.71 | 6 / 1 | |
| 5.1.70 | 6 / 1 | |
| 5.1.69 | 6 / 1 | |
| 5.1.68 | 6 / 1 | |
| 5.1.67 | 6 / 1 | |
| 5.1.66 | 6 / 1 | |
| 5.1.65 | 6 / 1 | |
| 5.1.64 | 6 / 1 | |
| 5.1.63 | 6 / 1 | |
| 5.1.62 | 6 / 1 | |
| 5.1.61 | 6 / 1 | |
| 5.1.60 | 6 / 1 | |
| 5.1.59 | 6 / 1 | |
| 5.1.58 | 6 / 1 | |
| 5.1.57 | 6 / 1 | |
| 5.1.56 | 6 / 1 | |
| 5.1.55 | 6 / 1 | |
| 5.1.54 | 6 / 1 | |
| 5.1.53 | 6 / 1 | |
| 5.1.52 | 6 / 1 | |
| 5.1.51 | 6 / 1 | |
| 5.1.50 | 6 / 1 | |
| 5.1.49 | 6 / 1 | |
| 5.1.48 | 6 / 1 | |
| 5.1.47 | 6 / 1 | |
| 5.1.46 | 6 / 1 | |
| 5.1.45 | 6 / 1 | |
| 5.1.44 | 6 / 1 | |
| 5.1.43 | 6 / 1 | |
| 5.1.42 | 6 / 1 | |
| 5.1.41 | 6 / 1 | |
| 5.1.40 | 6 / 1 | |
| 5.1.39 | 6 / 1 | |
| 5.1.38 | 6 / 1 | |
| 5.1.37 | 6 / 1 | |
| 5.1.36 | 6 / 1 | |
| 5.1.35 | 6 / 1 | |
| 5.1.34 | 6 / 1 | |
| 5.1.33 | 6 / 1 | |
| 5.1.32 | 6 / 1 | |
| 5.1.31 | 6 / 1 | |
| 5.1.30 | 6 / 1 | |
| 5.1.29 | 6 / 1 | |
| 5.1.28 | 6 / 1 | |
| 5.1.27 | 6 / 1 | |
| 5.1.26 | 6 / 1 | |
| 5.1.25 | 6 / 1 | |
| 5.1.24 | 6 / 1 | |
| 5.1.23 | 6 / 1 | |
| 5.1.22 | 6 / 1 | |
| 5.1.21 | 6 / 1 | |
| 5.1.20 | 6 / 1 | |
| 5.1.19 | 6 / 1 | |
| 5.1.18 | 6 / 1 | |
| 5.1.17 | 6 / 1 | |
| 5.1.16 | 6 / 1 | |
| 5.1.15 | 6 / 1 | |
| 5.1.14 | 6 / 1 | |
| 5.1.13 | 6 / 1 |
v5.1.72
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.71
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.70
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.69
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.68
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.67
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.66
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.65
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.64
2 findingsThis version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.63
2 findingsThis version was published by a different npm account than previous versions on 2026-03-12. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.62
2 findingsThis version was published by a different npm account than previous versions on 2026-02-25. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.61
2 findingsThis version was published by a different npm account than previous versions on 2026-02-05. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.60
2 findingsThis version was published by a different npm account than previous versions on 2026-01-29. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.59
2 findingsThis version was published by a different npm account than previous versions on 2026-01-16. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.58
2 findingsThis version was published by a different npm account than previous versions on 2026-01-08. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.57
2 findingsThis version was published by a different npm account than previous versions on 2026-01-05. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.56
2 findingsThis version was published by a different npm account than previous versions on 2025-12-15. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.55
2 findingsThis version was published by a different npm account than previous versions on 2025-12-03. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.54
2 findingsThis version was published by a different npm account than previous versions on 2025-12-02. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.53
2 findingsThis version was published by a different npm account than previous versions on 2025-11-13. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.52
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.51
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.50
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.49
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.48
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.47
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.46
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.45
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.44
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.43
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.42
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.41
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.40
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.39
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.38
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.37
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.36
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.35
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.