@loomhq/record-sdk
The Loom Software Development Kit
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:react-laag | AI (dependencies): react-laag is a well-known React positioning library; legitimate dependency for a UI SDK. | ai | |
| dependencies | unvetted-dep:@loomhq/lens | AI (dependencies): Internal Loom/Atlassian design system package; consistent with the publisher's namespace. | ai | |
| dependencies | unvetted-dep:react-shadow | AI (dependencies): react-shadow is a well-known Shadow DOM library; legitimate for a UI SDK. | ai | |
| dependencies | unvetted-dep:@reduxjs/toolkit | AI (dependencies): @reduxjs/toolkit is the official Redux toolkit; widely used and trusted. | ai | |
| dependencies | unvetted-dep:focus-trap-react | AI (dependencies): focus-trap-react is a well-known accessibility library; legitimate for a UI SDK. | ai | |
| dependencies | unvetted-dep:react-hotkeys-hook | AI (dependencies): react-hotkeys-hook is a well-known keyboard shortcut library; legitimate for a UI SDK. | ai | |
| dependencies | unvetted-dep:react-type-animation | AI (dependencies): react-type-animation is a well-known animation library; legitimate for a UI SDK. | ai | |
| phantom-deps | phantom-dep:deepmerge | AI (phantom-deps): Declared as a direct dependency but used transitively or in config; common pattern, not a security concern. | ai | |
| phantom-deps | phantom-dep:memoize-one | AI (phantom-deps): Declared as a direct dependency but used transitively or in config; common pattern, not a security concern. | ai | |
| phantom-deps | phantom-dep:redux-thunk | AI (phantom-deps): Declared as a direct dependency but used transitively or in config; common pattern, not a security concern. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 4.12.2 | 20 / 26 | |
| 4.11.0 | 20 / 26 | |
| 4.10.4 | 20 / 26 | |
| 4.10.1 | 20 / 26 | |
| 4.10.0 | 20 / 26 | |
| 4.9.1 | 20 / 26 | |
| 4.9.0 | 20 / 26 | |
| 4.8.0 | 20 / 26 | |
| 4.7.1 | 20 / 26 | |
| 4.6.2 | 20 / 26 | |
| 4.4.0 | 20 / 26 | |
| 4.3.3 | 20 / 26 | |
| 4.2.3 | 20 / 26 | |
| 4.2.2 | 20 / 26 | |
| 4.2.1 | 20 / 26 | |
| 4.2.0 | 20 / 26 | |
| 4.1.1 | 20 / 26 | |
| 4.1.0 | 20 / 26 | |
| 4.0.0 | 19 / 26 |
v4.12.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.11.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.10.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.6.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.