@lmvz-ds/components
The components of the design system
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:cjs/index-3g9Z9sfF.js | AI (source-diff): Minified Stencil/effect bundle; long lines are CSS strings and fp-ts imports, not obfuscation. | ai | |
| source-diff | net-exec-file:lmvz-components/p-CGmJG63p.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | net-exec-file:components/p-CGmJG63p.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | net-exec-file:lmvz-components/p-0s99QfRy.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | net-exec-file:components/p-0s99QfRy.js | AI (source-diff): Stencil component bundle; false positive. | ai | |
| source-diff | net-exec-file:cjs/logger-DsM6xg6V.js | AI (source-diff): False positive on bundled logger code. | ai | |
| source-diff | net-exec-file:esm/logger-CGmJG63p.js | AI (source-diff): False positive on bundled logger code. | ai | |
| source-diff | obfuscated-file:esm/logger-CGmJG63p.js | AI (source-diff): Minified logger bundle; false positive. | ai | |
| source-diff | net-exec-file:esm/index-Dh_9sN0q.js | AI (source-diff): False positive on bundled effect library; no dropper behavior. | ai | |
| source-diff | obfuscated-file:esm/index-Dh_9sN0q.js | AI (source-diff): Same bundled effect/Stencil output; false positive. | ai | |
| source-diff | net-exec-file:cjs/index-3g9Z9sfF.js | AI (source-diff): Network+exec pattern fires on bundled effect library code; no actual dropper behavior in samples. | ai | |
| source-diff | obfuscated-file:components/p-DbeHBSOe.js | AI (source-diff): Stencil build output; false positive. | ai | |
| source-diff | net-exec-file:esm/index-BvxaUA12.js | AI (source-diff): Effect-TS bundle; network/exec patterns are library internals, not dropper behavior. | ai | |
| source-diff | obfuscated-file:esm/logger-0bL3pydp.js | AI (source-diff): Bundled Effect-TS logger; minified library code, not obfuscated malware. | ai | |
| source-diff | net-exec-file:esm/logger-0bL3pydp.js | AI (source-diff): Same Effect-TS bundle; false positive for this design system package. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-0bL3pydp.js | AI (source-diff): Stencil chunk of Effect-TS; minified build artifact. | ai | |
| source-diff | net-exec-file:lmvz-components/p-0bL3pydp.js | AI (source-diff): Same Stencil/Effect-TS chunk; false positive. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-DHZwxmLb.js | AI (source-diff): Stencil build chunk; minified web component code. | ai | |
| source-diff | net-exec-file:lmvz-components/p-DHZwxmLb.js | AI (source-diff): Stencil chunk; false positive for this design system. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-40569208.entry.js | AI (source-diff): Stencil entry chunk for web component; standard minified output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-49ab22bd.entry.js | AI (source-diff): Stencil entry chunk; icon component with IntersectionObserver, not malware. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-BxHnZA0M.js | AI (source-diff): Stencil shared chunk; minified build artifact. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-6e8acbd9.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-9626e951.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-e1b847d2.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-ec96c6b6.entry.js | AI (source-diff): Stencil entry chunk; minified web component. | ai | |
| source-diff | obfuscated-file:esm/index-BvxaUA12.js | AI (source-diff): Stencil/Vite bundled output of Effect-TS library; minified but not malicious. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-7a6bec13.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-84267405.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-6dbb3f13.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-5aa17cd2.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-30b99f11.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-0a41cc24.entry.js | AI (source-diff): Standard Stencil.js minified component chunk; readable logic, no malicious patterns. | ai | |
| license | uncommon-license:UNLICENSED | AI (license): Intentionally proprietary/internal package; UNLICENSED is consistent across all versions. | ai | |
| provenance | no-provenance | AI (provenance): Internal enterprise design system; provenance attestation not expected for this publisher/scope. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-c7e368c4.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-1506fa34.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output; minified but readable component logic, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-bbab5471.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-93038c98.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-872e2106.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai | |
| source-diff | obfuscated-file:lmvz-components/p-80675ee5.entry.js | AI (source-diff): Standard Stencil.js chunked ESM build output. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.23.0 | 2 / 0 | |
| 0.20.0 | 2 / 0 | |
| 0.19.0 | 2 / 0 | |
| 0.18.2 | 2 / 0 | |
| 0.18.1 | 2 / 0 | |
| 0.18.0 | 2 / 0 | |
| 0.17.1 | 3 / 23 | |
| 0.17.0 | 3 / 23 |
v0.23.0
34 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nmzpadsat.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.20.0
30 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nmzpadsat.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.0
19 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nmzpadsat.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.2
8 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: nmzpadsat.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.1
7 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.