@m4l/components
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @m4l/base is a first-party same-org dep; addition is consistent with existing @m4l/* deps in this package. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used only to read a __version string property; not obfuscation, stable pattern for this package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable pattern across all versions of this internal package; not a malice signal. | ai | |
| dependencies | unvetted-dep:react-data-grid | AI (dependencies): react-data-grid beta pinned at a specific version; consistent usage pattern for this package. | ai | |
| phantom-deps | phantom-dep:@mui/lab | AI (phantom-deps): MUI lab is a peer dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): react-dom is a standard peer dep for React component libraries. | ai | |
| phantom-deps | phantom-dep:jwt-decode | AI (phantom-deps): Declared dep for consumers; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:atmosphere.js | AI (phantom-deps): Declared dep for consumers; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-leaflet | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-chartjs-2 | AI (phantom-deps): Peer dep for chart components; stable false positive. | ai | |
| phantom-deps | phantom-dep:@googlemaps/js-api-loader | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:leaflet-polylinedecorator | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:storybook-multilevel-sort | AI (phantom-deps): Dev/storybook dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-intersection-observer | AI (phantom-deps): Declared dep for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-virtualized-auto-sizer | AI (phantom-deps): Declared dep for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@geoman-io/leaflet-geoman-free | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:leaflet.markercluster | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:qs | AI (phantom-deps): UI component library legitimately declares peer/optional deps not directly imported in every file. | ai | |
| phantom-deps | phantom-dep:install | AI (phantom-deps): Same pattern — declared dep for consumers, not a direct import in library source. | ai | |
| phantom-deps | phantom-dep:leaflet | AI (phantom-deps): Leaflet is a peer dep for map components; stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal scoped UI library (@m4l/components); missing metadata is consistent across its 1020 versions, not a spam indicator. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 9.9.0 | 40 / 0 | |
| 9.6.0 | 40 / 0 | |
| 9.5.11 | 40 / 0 | |
| 9.5.9 | 40 / 0 | |
| 9.5.8 | 40 / 0 | |
| 9.5.7 | 39 / 0 | |
| 9.5.2 | 39 / 0 | |
| 9.4.16 | 48 / 0 | |
| 9.3.21 | 48 / 0 | |
| 9.3.20 | 49 / 0 | |
| 9.3.18 | 49 / 0 | |
| 9.3.17 | 49 / 0 | |
| 9.2.48 | 54 / 0 | |
| 9.2.46 | 54 / 0 | |
| 9.2.45 | 54 / 0 | |
| 9.2.44 | 54 / 0 | |
| 9.2.39 | 53 / 0 |
v9.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.4.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.48
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.46
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.45
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.44
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.39
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.