@moneybutton/react-money-button
Money Button React Component
5
Versions
Open-BSV
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ryanxcharlescalvo.genericodmark-fabriikelijahb
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): MoneyButton is a known org; ryanxcharles is the long-standing publisher with strong track record. Internal team changes are expected over the package's 7+ year history. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop is consistent with refactoring functionality into @moneybutton/postmessage-client (same org). Not indicative of malicious stubbing. | ai | |
| provenance | publisher-changed | AI (provenance): ryanxcharles (Ryan X. Charles) is the founder of MoneyButton/Yours Inc. and the canonical author; the 2020 transition from calvo.generico is a legitimate maintainer handoff, not a compromise. | ai | |
| phantom-deps | phantom-dep:@moneybutton/postmessage-client | AI (phantom-deps): Same-org sibling package; expected dependency pattern for the MoneyButton ecosystem. | ai | |
| license | uncommon-license:Open-BSV | AI (license): Open-BSV is the expected license for MoneyButton ecosystem packages; stable for this package across all versions. | ai | |
| dependencies | unvetted-dep:create-react-library | AI (dependencies): create-react-library is a known build scaffolding tool; phantom-dep finding confirms it is not imported at runtime, only referenced in config. No security risk. | ai | |
| phantom-deps | phantom-dep:create-react-library | AI (phantom-deps): Confirmed not imported at runtime; it's a build tool mistakenly listed as a runtime dependency. Packaging quirk, not a security issue. | ai | |
| phantom-deps | phantom-dep:query-string | AI (phantom-deps): query-string is declared but not directly imported; used only in config. No security risk for this package. | ai |