@m4l/components
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:components/CommonActions/components/ActionFormSubmitProgrammatic/slots/ActionFormSubmitProgrammaticSlots.d.ts | AI (source-diff): Long-line .d.ts is generated TS type union from Emotion/MUI, not obfuscation. | ai | |
| source-diff | obfuscated-file:components/ColorPicker/slots/ColorPickerSlots.d.ts | AI (source-diff): Long-line .d.ts type declarations from MUI/Emotion generics, not obfuscated code. | ai | |
| source-diff | obfuscated-file:components/ImageSelector/slots/ImageSelectorSlots.d.ts | AI (source-diff): Same pattern: minified type declarations, not obfuscation. | ai | |
| source-diff | obfuscated-file:components/DaysOfWeekPicker/slots/DaysOfWeekPickerSlots.d.ts | AI (source-diff): Long-line .d.ts TypeScript generic type declarations, not obfuscated code. | ai | |
| source-diff | obfuscated-file:components/ObjectLogs/slots/ObjectLogsSlots.d.ts | AI (source-diff): Long-line .d.ts type declarations, not obfuscated executable code. | ai | |
| source-diff | obfuscated-file:components/DaysOfMonthPicker/slots/DaysOfMonthPickerSlots.d.ts | AI (source-diff): Long-line .d.ts type declarations, not obfuscated executable code. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Expected growth for a large component library adding a new picker module. | ai | |
| source-diff | obfuscated-file:components/extended/React-resizable-panels/slots/SplitLayoutSlots.d.ts | AI (source-diff): Generated TS declaration file with long type unions, not obfuscated code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @m4l/base is a first-party same-org dep; addition is consistent with existing @m4l/* deps in this package. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get used only to read a __version string property; not obfuscation, stable pattern for this package. | ai | |
| dependencies | unvetted-dep:react-data-grid | AI (dependencies): react-data-grid beta pinned at a specific version; consistent usage pattern for this package. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Stable pattern across all versions of this internal package; not a malice signal. | ai | |
| phantom-deps | phantom-dep:leaflet-polylinedecorator | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:storybook-multilevel-sort | AI (phantom-deps): Dev/storybook dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-virtualized-auto-sizer | AI (phantom-deps): Declared dep for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:@geoman-io/leaflet-geoman-free | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-intersection-observer | AI (phantom-deps): Declared dep for consumers; stable false positive. | ai | |
| phantom-deps | phantom-dep:qs | AI (phantom-deps): UI component library legitimately declares peer/optional deps not directly imported in every file. | ai | |
| phantom-deps | phantom-dep:install | AI (phantom-deps): Same pattern — declared dep for consumers, not a direct import in library source. | ai | |
| phantom-deps | phantom-dep:leaflet | AI (phantom-deps): Leaflet is a peer dep for map components; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@mui/lab | AI (phantom-deps): MUI lab is a peer dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): react-dom is a standard peer dep for React component libraries. | ai | |
| phantom-deps | phantom-dep:jwt-decode | AI (phantom-deps): Declared dep for consumers; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:atmosphere.js | AI (phantom-deps): Declared dep for consumers; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-leaflet | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:react-chartjs-2 | AI (phantom-deps): Peer dep for chart components; stable false positive. | ai | |
| phantom-deps | phantom-dep:leaflet.markercluster | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| phantom-deps | phantom-dep:@googlemaps/js-api-loader | AI (phantom-deps): Peer dep for map components; stable false positive. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal scoped UI library (@m4l/components); missing metadata is consistent across its 1020 versions, not a spam indicator. | ai |
Versions (showing 100 of 365)
| Version | Deps | Published |
|---|---|---|
| 9.2.19 | 53 / 0 | |
| 9.2.18 | 53 / 0 | |
| 9.2.17 | 53 / 0 | |
| 9.2.16 | 53 / 0 | |
| 9.2.12 | 47 / 0 | |
| 9.2.11 | 47 / 0 | |
| 9.2.10 | 47 / 0 | |
| 9.2.9 | 47 / 0 | |
| 9.2.8 | 47 / 0 | |
| 9.2.7 | 47 / 0 | |
| 9.2.6 | 47 / 0 | |
| 9.2.5 | 47 / 0 | |
| 9.2.4 | 47 / 0 | |
| 9.2.2 | 47 / 0 | |
| 9.2.1 | 46 / 0 | |
| 9.2.0 | 46 / 0 | |
| 9.1.151 | 46 / 0 | |
| 9.1.150 | 46 / 0 | |
| 9.1.149 | 46 / 0 | |
| 9.1.148 | 46 / 0 | |
| 9.1.147 | 46 / 0 | |
| 9.1.146 | 46 / 0 | |
| 9.1.145 | 46 / 0 | |
| 9.1.144 | 46 / 0 | |
| 9.1.143 | 46 / 0 | |
| 9.1.142 | 46 / 0 | |
| 9.1.141 | 46 / 0 | |
| 9.1.140 | 46 / 0 | |
| 9.1.139 | 46 / 0 | |
| 9.1.138 | 46 / 0 | |
| 9.1.137 | 46 / 0 | |
| 9.1.136 | 46 / 0 | |
| 9.1.135 | 46 / 0 | |
| 9.1.134 | 46 / 0 | |
| 9.1.133 | 46 / 0 | |
| 9.1.132 | 46 / 0 | |
| 9.1.131 | 46 / 0 | |
| 9.1.130 | 46 / 0 | |
| 9.1.129 | 46 / 0 | |
| 9.1.128 | 46 / 0 | |
| 9.1.127 | 46 / 0 | |
| 9.1.126 | 46 / 0 | |
| 9.1.125 | 45 / 0 | |
| 9.1.124 | 45 / 0 | |
| 9.1.122 | 45 / 0 | |
| 9.1.121 | 45 / 0 | |
| 9.1.120 | 45 / 0 | |
| 9.1.119 | 45 / 0 | |
| 9.1.118 | 45 / 0 | |
| 9.1.117 | 45 / 0 | |
| 9.1.116 | 45 / 0 | |
| 9.1.115 | 45 / 0 | |
| 9.1.114 | 45 / 0 | |
| 9.1.113 | 45 / 0 | |
| 9.1.112 | 45 / 0 | |
| 9.1.111 | 45 / 0 | |
| 9.1.110 | 45 / 0 | |
| 9.1.109 | 45 / 0 | |
| 9.1.108 | 45 / 0 | |
| 9.1.107 | 45 / 0 | |
| 9.1.106 | 45 / 0 | |
| 9.1.105 | 45 / 0 | |
| 9.1.104 | 45 / 0 | |
| 9.1.103 | 45 / 0 | |
| 9.1.102 | 45 / 0 | |
| 9.1.101 | 45 / 0 | |
| 9.1.100 | 45 / 0 | |
| 9.1.99 | 45 / 0 | |
| 9.1.98 | 45 / 0 | |
| 9.1.97 | 45 / 0 | |
| 9.1.96 | 45 / 0 | |
| 9.1.95 | 45 / 0 | |
| 9.1.94 | 45 / 0 | |
| 9.1.93 | 45 / 0 | |
| 9.1.92 | 45 / 0 | |
| 9.1.91 | 45 / 0 | |
| 9.1.90 | 45 / 0 | |
| 9.1.89 | 45 / 0 | |
| 9.1.88 | 45 / 0 | |
| 9.1.87 | 45 / 0 | |
| 9.1.86 | 45 / 0 | |
| 9.1.85 | 45 / 0 | |
| 9.1.84 | 45 / 0 | |
| 9.1.83 | 45 / 0 | |
| 9.1.82 | 45 / 0 | |
| 9.1.81 | 45 / 0 | |
| 9.1.80 | 45 / 0 | |
| 9.1.79 | 45 / 0 | |
| 9.1.78 | 45 / 0 | |
| 9.1.77 | 45 / 0 | |
| 9.1.76 | 45 / 0 | |
| 9.1.75 | 45 / 0 | |
| 9.1.74 | 45 / 0 | |
| 9.1.73 | 45 / 0 | |
| 9.1.72 | 45 / 0 | |
| 9.1.71 | 45 / 0 | |
| 9.1.70 | 45 / 0 | |
| 9.1.69 | 45 / 0 | |
| 9.1.68 | 45 / 0 | |
| 9.1.67 | 45 / 0 |
v9.2.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.151
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.150
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.149
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.148
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.147
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.146
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.145
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.144
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.143
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.142
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.141
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.140
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.139
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.138
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.137
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.136
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.135
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.134
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.133
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.132
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.131
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.130
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.129
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.128
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.127
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.126
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.125
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.124
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.122
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.121
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.120
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.119
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.118
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.117
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.116
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.115
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.114
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.113
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.112
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.111
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.110
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.109
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.108
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.107
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.106
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.105
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.104
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.103
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.102
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.101
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.100
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.99
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.98
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.97
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.96
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.95
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.94
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.93
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.92
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.91
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.90
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.89
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.88
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.87
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.86
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.85
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.84
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.83
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.82
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.81
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.80
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.79
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.78
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.77
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.76
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.75
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.74
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.73
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.72
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.71
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.70
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.68
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.67
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.