@lm_fe/components_m
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/a_chunks/modals.entries.子痫前期风险评估表.js | AI (source-diff): Standard Rollup/Babel minified output; imports are legible and reference known packages only. | ai | |
| source-diff | obfuscated-file:dist/a_chunks/modals.entries.预警提醒_高危快讯.js | AI (source-diff): Standard Rollup/Babel minified output; imports are legible and reference known packages only. | ai | |
| source-diff | obfuscated-file:dist/a_chunks/modals.entries.高危因素管理.js | AI (source-diff): Standard Rollup/Babel minified output; imports are legible and reference known packages only. | ai | |
| source-diff | obfuscated-file:dist/a_chunks/components_m.src.MyForm.js | AI (source-diff): File is Babel-transpiled output with readable helper imports, not obfuscated; expected for this rollup-built component library. | ai | |
| dependencies | unvetted-dep:@lm_fe/provoke | AI (dependencies): Same org scope as this package; consistent with internal monorepo dependency. | ai | |
| provenance | no-provenance | AI (provenance): Internal org package; no provenance is consistent with all prior versions in this scope. | ai | |
| phantom-deps | phantom-dep:@lm_fe/scripts | AI (phantom-deps): Same-org build tooling dep; phantom detection is a stable false positive here. | ai | |
| phantom-deps | phantom-dep:quill | AI (phantom-deps): quill is a peer/config-level dep for react-quill; not directly imported is expected. | ai | |
| phantom-deps | phantom-dep:echarts | AI (phantom-deps): echarts referenced in config/wrapper pattern; stable false positive for this component library. | ai | |
| phantom-deps | phantom-dep:history | AI (phantom-deps): history is a peer dep for routing; not directly imported is expected in a component library. | ai | |
| phantom-deps | phantom-dep:qrcode.react | AI (phantom-deps): Component library wrapping qrcode.react; config-level reference is expected pattern. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 0.2.12 | 6 / 7 | |
| 0.2.11 | 6 / 7 | |
| 0.2.10 | 6 / 7 | |
| 0.2.8 | 6 / 7 | |
| 0.2.7 | 6 / 7 | |
| 0.2.6 | 6 / 7 | |
| 0.2.5 | 6 / 7 | |
| 0.2.2 | 6 / 7 | |
| 0.1.211 | 15 / 4 | |
| 0.1.210 | 15 / 4 | |
| 0.1.209 | 15 / 4 | |
| 0.1.207 | 15 / 4 | |
| 0.1.206 | 15 / 4 | |
| 0.1.205 | 15 / 4 | |
| 0.1.201 | 15 / 6 |
v0.1.207
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.206
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.205
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.201
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.