@microsoft/sp-dialog
SharePoint Framework support for displaying dialog boxes
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/sp-dialog_none_69623abbc5403c90e5a7.js | AI (source-diff): Standard SPFx webpack bundle output; AMD define() with known Microsoft/FluentUI deps, not malicious obfuscation. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): microsoft-oss-releases is Microsoft's OSS release automation account; consistent with org-wide release pipeline. | ai | |
| provenance | no-provenance | AI (provenance): Microsoft SPFx packages are published from internal pipelines without Sigstore attestation; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@fluentui/react | AI (dependencies): @fluentui/react is the official Microsoft Fluent UI library; expected dependency for this SPFx dialog package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Microsoft SPFx SDK component; sparse README/keywords are typical for this package family. | ai | |
| phantom-deps | phantom-dep:@swc/helpers | AI (phantom-deps): Known implicit SWC transpiler runtime dep; stable pattern for this package. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 1.23.0 | 10 / 7 | |
| 1.22.2 | 10 / 7 | |
| 1.22.1 | 10 / 7 | |
| 1.22.0 | 10 / 7 | |
| 1.21.1 | 10 / 7 |
v1.23.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.21.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.