@lynx-js/react-canary
ReactLynx is a framework for developing Lynx applications with familiar React.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:transform/dist/wasm.cjs | AI (source-diff): Encoded string is a base64-encoded WASM binary loaded via __toBinary; legitimate compiled artifact for the React transform pipeline. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Documented use for webpack snapshot variable access; input is controlled build output, not user-supplied. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used in a Proxy handler for legitimate property forwarding; standard JS pattern. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established package with 1206 versions; README style and missing keywords are cosmetic, not malicious. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 0.121.1 | 1 / 3 | |
| 0.121.0 | 1 / 3 | |
| 0.120.0 | 1 / 3 | |
| 0.119.0 | 1 / 3 | |
| 0.118.0 | 1 / 3 | |
| 0.117.1 | 1 / 3 |
v0.121.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.121.0
2 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.120.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.119.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.118.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.117.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.