← Home

@marigold/system

npm Repository

Marigold System Library

16
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sebastiansebaldsarahgmaromko

Keywords

marigoldsystemlibraryreactstylingcss

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-added AI (maintainer-change): Package has SLSA provenance via CI/CD; maintainer addition on a well-established org package is expected org growth, not a takeover signal. ai
dependencies unvetted-dep:cva AI (dependencies): cva is the official rename/successor of class-variance-authority by the same author; low risk substitution. ai
provenance publisher-changed AI (provenance): Transition from human publisher to GitHub Actions CI/CD, confirmed by SLSA provenance attestation. Stable for this package going forward. ai
phantom-deps phantom-dep:deepmerge AI (phantom-deps): deepmerge is a declared runtime dependency; phantom-dep heuristic is a false positive for this package. ai
phantom-deps phantom-dep:react-fast-compare AI (phantom-deps): react-fast-compare is a declared runtime dependency; phantom-dep heuristic is a false positive for this package. ai

Versions (showing 16 of 16)

Version Deps Published
17.9.1 6 / 7
17.9.0 6 / 7
17.6.0 6 / 7
17.5.1 6 / 7
17.5.0 6 / 7
17.4.0 6 / 7
17.3.1 6 / 7
17.3.0 6 / 7
17.2.1 6 / 7
17.2.0 6 / 7
17.1.0 6 / 7
17.0.1 6 / 7
17.0.0 6 / 7
16.1.0 6 / 7
16.0.1 6 / 7
16.0.0 6 / 7

v17.9.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v17.9.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.