@macrostrat/data-sheet
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/node/data-sheet.dffdda71.js | AI (source-diff): Parcel build output; minified but readable imports of known deps matching package purpose. | ai | |
| source-diff | obfuscated-file:dist/node/data-sheet.2a613259.js | AI (source-diff): Parcel build output; minified but readable imports of known deps matching package purpose. | ai | |
| source-diff | obfuscated-file:dist/node/data-sheet.6a663031.js | AI (source-diff): Parcel build output; minified but readable imports of known deps matching package purpose. | ai | |
| source-diff | obfuscated-file:dist/node/data-sheet.f3404ed5.js | AI (source-diff): Parcel bundler minified output; readable imports confirm legitimate React/Blueprint code. | ai | |
| phantom-deps | phantom-dep:chroma-js | AI (phantom-deps): Declared dep used transitively via bundled dist; phantom-dep heuristic fires on bundled packages. | ai | |
| phantom-deps | phantom-dep:react-color | AI (phantom-deps): Same bundled-dist false positive pattern. | ai | |
| phantom-deps | phantom-dep:classnames | AI (phantom-deps): Same bundled-dist false positive pattern. | ai | |
| source-diff | obfuscated-file:dist/node/data-sheet.4a8fd8a7.js | AI (source-diff): Parcel bundler minified output; readable imports confirm legitimate React/Blueprint code. | ai | |
| source-diff | obfuscated-file:dist/node/data-sheet.d40ac2ae.js | AI (source-diff): Parcel bundler minified output; readable imports confirm legitimate React/Blueprint code. | ai | |
| provenance | no-provenance | AI (provenance): Established @macrostrat monorepo package; no provenance is consistent across all versions. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 4.2.1 | 14 / 2 | |
| 4.2.0 | 14 / 2 | |
| 4.1.1 | 14 / 1 | |
| 4.1.0 | 14 / 1 | |
| 4.0.1 | 14 / 1 | |
| 4.0.0 | 14 / 1 | |
| 3.1.0 | 14 / 1 | |
| 3.0.4 | 13 / 1 | |
| 3.0.3 | 13 / 1 | |
| 3.0.2 | 13 / 1 | |
| 3.0.1 | 15 / 1 | |
| 3.0.0 | 15 / 1 | |
| 2.2.4 | 15 / 2 | |
| 2.2.3 | 16 / 2 | |
| 2.2.2 | 16 / 2 | |
| 2.2.1 | 16 / 2 |
v4.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.