@m4l/components — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

made4labs

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:components/CommonActions/components/ActionFormSubmitProgrammatic/slots/ActionFormSubmitProgrammaticSlots.d.ts	AI (source-diff): Long-line .d.ts is generated TS type union from Emotion/MUI, not obfuscation.	ai	2026/07/08
source-diff	obfuscated-file:components/ColorPicker/slots/ColorPickerSlots.d.ts	AI (source-diff): Long-line .d.ts type declarations from MUI/Emotion generics, not obfuscated code.	ai	2026/07/08
source-diff	obfuscated-file:components/ImageSelector/slots/ImageSelectorSlots.d.ts	AI (source-diff): Same pattern: minified type declarations, not obfuscation.	ai	2026/07/08
source-diff	obfuscated-file:components/DaysOfWeekPicker/slots/DaysOfWeekPickerSlots.d.ts	AI (source-diff): Long-line .d.ts TypeScript generic type declarations, not obfuscated code.	ai	2026/07/08
source-diff	obfuscated-file:components/ObjectLogs/slots/ObjectLogsSlots.d.ts	AI (source-diff): Long-line .d.ts type declarations, not obfuscated executable code.	ai	2026/07/08
source-diff	obfuscated-file:components/DaysOfMonthPicker/slots/DaysOfMonthPickerSlots.d.ts	AI (source-diff): Long-line .d.ts type declarations, not obfuscated executable code.	ai	2026/07/08
source-diff	large-new-source-files	AI (source-diff): Expected growth for a large component library adding a new picker module.	ai	2026/07/08
source-diff	obfuscated-file:components/extended/React-resizable-panels/slots/SplitLayoutSlots.d.ts	AI (source-diff): Generated TS declaration file with long type unions, not obfuscated code.	ai	2026/07/08
publish-pattern	new-deps-added	AI (publish-pattern): @m4l/base is a first-party same-org dep; addition is consistent with existing @m4l/* deps in this package.	ai	2026/06/05
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get used only to read a __version string property; not obfuscation, stable pattern for this package.	ai	2026/05/31
dependencies	unvetted-dep:react-data-grid	AI (dependencies): react-data-grid beta pinned at a specific version; consistent usage pattern for this package.	ai	2026/05/22
npm-metadata	no-description	AI (npm-metadata): Stable pattern across all versions of this internal package; not a malice signal.	ai	2026/05/22
phantom-deps	phantom-dep:leaflet-polylinedecorator	AI (phantom-deps): Peer dep for map components; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:storybook-multilevel-sort	AI (phantom-deps): Dev/storybook dep; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:react-virtualized-auto-sizer	AI (phantom-deps): Declared dep for consumers; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:@geoman-io/leaflet-geoman-free	AI (phantom-deps): Peer dep for map components; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:react-intersection-observer	AI (phantom-deps): Declared dep for consumers; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:qs	AI (phantom-deps): UI component library legitimately declares peer/optional deps not directly imported in every file.	ai	2026/05/22
phantom-deps	phantom-dep:install	AI (phantom-deps): Same pattern — declared dep for consumers, not a direct import in library source.	ai	2026/05/22
phantom-deps	phantom-dep:leaflet	AI (phantom-deps): Leaflet is a peer dep for map components; stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:@mui/lab	AI (phantom-deps): MUI lab is a peer dep; stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:react-dom	AI (phantom-deps): react-dom is a standard peer dep for React component libraries.	ai	2026/05/22
phantom-deps	phantom-dep:jwt-decode	AI (phantom-deps): Declared dep for consumers; stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:atmosphere.js	AI (phantom-deps): Declared dep for consumers; stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:react-leaflet	AI (phantom-deps): Peer dep for map components; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:react-chartjs-2	AI (phantom-deps): Peer dep for chart components; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:leaflet.markercluster	AI (phantom-deps): Peer dep for map components; stable false positive.	ai	2026/05/22
phantom-deps	phantom-dep:@googlemaps/js-api-loader	AI (phantom-deps): Peer dep for map components; stable false positive.	ai	2026/05/22
bogus-package	bogus-package	AI (bogus-package): Internal scoped UI library (@m4l/components); missing metadata is consistent across its 1020 versions, not a spam indicator.	ai	2026/05/21

Versions (showing 51 of 364)

View all versions

Version	Deps	Published
9.40.0	42 / 0	2026-07-24
9.39.0	42 / 0	2026-07-23
9.38.0	42 / 0	2026-07-23
9.37.0	42 / 0	2026-07-23
9.36.0	42 / 0	2026-07-20
9.35.0	42 / 0	2026-07-15
9.34.0	42 / 0	2026-07-08
9.33.1	39 / 0	2026-07-06
9.33.0	39 / 0	2026-07-04
9.32.0	39 / 0	2026-07-03
9.31.0	39 / 0	2026-07-03
9.30.2	39 / 0	2026-07-02
9.30.1	40 / 0	2026-07-02
9.30.0	40 / 0	2026-06-30
9.29.0	40 / 0	2026-06-30
9.28.0	40 / 0	2026-06-24
9.27.0	40 / 0	2026-06-23
9.26.0	40 / 0	2026-06-23
9.25.1	40 / 0	2026-06-22
9.25.0	40 / 0	2026-06-21
9.24.0	40 / 0	2026-06-19
9.23.1	40 / 0	2026-06-18
9.23.0	40 / 0	2026-06-18
9.22.3	40 / 0	2026-06-18
9.22.2	40 / 0	2026-06-17
9.22.1	40 / 0	2026-06-17
9.22.0	40 / 0	2026-06-17
9.21.0	40 / 0	2026-06-17
9.20.0	40 / 0	2026-06-16
9.19.0	40 / 0	2026-06-16
9.18.0	40 / 0	2026-06-13
9.17.0	40 / 0	2026-06-12
9.16.0	40 / 0	2026-06-12
9.15.0	40 / 0	2026-06-10
9.14.0	40 / 0	2026-06-05
9.13.0	40 / 0	2026-06-04
9.12.0	40 / 0	2026-06-03
9.11.0	40 / 0	2026-06-03
9.10.1	40 / 0	2026-06-02
9.10.0	40 / 0	2026-05-29
9.9.0	40 / 0	2026-05-27
9.8.0	40 / 0	2026-05-25
9.7.0	40 / 0	2026-05-13
9.6.0	40 / 0	2026-05-12
9.5.14	40 / 0	2026-05-09
9.5.13	40 / 0	2026-05-05
9.5.12	40 / 0	2026-05-05
9.5.11	40 / 0	2026-05-04
9.5.10	40 / 0	2026-05-04
9.5.9	40 / 0	2026-05-04
9.5.8	40 / 0	2026-05-04

v9.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.34.0

2 findings

HIGH New obfuscated file: components/extended/ReactSimpleCodeEditor/slots/CodeEditorSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.33.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.33.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.30.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.30.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.29.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.28.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.27.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.26.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.25.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.25.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.24.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.23.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.23.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.22.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.22.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.22.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.22.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.21.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.20.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.19.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.18.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.16.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.15.0

3 findings

HIGH New obfuscated file: components/ColorPicker/slots/ColorPickerSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: components/ImageSelector/slots/ImageSelectorSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.14.0

3 findings

HIGH New obfuscated file: components/ColorPicker/slots/ColorPickerSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: components/ImageSelector/slots/ImageSelectorSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.13.0

3 findings

HIGH New obfuscated file: components/ColorPicker/slots/ColorPickerSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: components/ImageSelector/slots/ImageSelectorSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.12.0

2 findings

HIGH New obfuscated file: components/ColorPicker/slots/ColorPickerSlots.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.5.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.5.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v9.5.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.