@moneydevkit/nextjs — Greenflagged

moneydevkit checkout components for Next.js.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

martinsaponatelkinsamackillopezefrd-mdknpslaney

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Large file count reflects genuine feature expansion (server API client, actions, routes); not injected payload.	ai	2026/05/31
source-diff	source-size-tripled	AI (source-diff): Size increase matches addition of server-side modules and type declarations; consistent with changelog.	ai	2026/05/31
provenance	missing-githead	AI (provenance): SLSA provenance attestation present; missing gitHead is superseded by Sigstore attestation for this package.	ai	2026/05/29
dependencies	unvetted-dep:@moneydevkit/api-contract	AI (dependencies): Same-org dependency within the moneydevkit scope; consistent across versions of this package.	ai	2026/05/27
phantom-deps	phantom-dep:@orpc/client	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:lucide-react	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:qrcode.react	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@orpc/contract	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:tailwind-merge	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:react-hook-form	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@hookform/resolvers	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@radix-ui/react-slot	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
typosquat	typosquat.levenshtein:next	AI (typosquat): Scoped @moneydevkit/nextjs is a Next.js integration package, not a typosquat of 'next'.	ai	2026/04/30
phantom-deps	phantom-dep:@tanstack/react-query	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@radix-ui/react-dialog	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@radix-ui/react-select	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:class-variance-authority	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@moneydevkit/api-contract	AI (phantom-deps): Same-org scoped package; phantom-dep heuristic is a false positive here.	ai	2026/04/30
phantom-deps	phantom-dep:@moneydevkit/lightning-js	AI (phantom-deps): Same-org scoped package; phantom-dep heuristic is a false positive here.	ai	2026/04/30
phantom-deps	phantom-dep:@radix-ui/react-collapsible	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:@radix-ui/react-label	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:zod	AI (phantom-deps): Component library declares peer-like deps as regular deps; phantom-dep heuristic fires on bundled/re-exported deps.	ai	2026/04/30
phantom-deps	phantom-dep:clsx	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30
phantom-deps	phantom-dep:vaul	AI (phantom-deps): Same pattern — bundled UI library dep, stable false positive.	ai	2026/04/30

Versions (showing 41 of 41)

Version	Deps	Published
0.19.0	20 / 4	2026-06-01
0.18.0	20 / 4	2026-05-22
0.17.0	20 / 4	2026-05-13
0.16.0	20 / 4	2026-04-24
0.15.0	20 / 4	2026-04-01
0.13.0	20 / 4	2026-02-26
0.12.0	20 / 4	2026-02-23
0.11.0	20 / 4	2026-02-13
0.10.0	20 / 4	2026-02-11
0.9.0	20 / 4	2026-02-02
0.7.0	20 / 4	2026-01-20
0.6.2	20 / 4	2026-01-17
0.6.1	20 / 4	2026-01-14
0.4.0	20 / 4	2025-12-30
0.3.2	20 / 4	2025-12-17
0.3.0	20 / 4	2025-12-11
0.2.0	20 / 4	2025-12-09
0.1.23	16 / 4	2025-12-01
0.1.22	17 / 4	2025-12-01
0.1.21	19 / 4	2025-11-28
0.1.20	19 / 4	2025-11-28
0.1.19	20 / 4	2025-11-26
0.1.18	20 / 4	2025-11-26
0.1.17	19 / 4	2025-11-26
0.1.16	19 / 4	2025-11-26
0.1.15	19 / 4	2025-11-26
0.1.14	20 / 4	2025-11-26
0.1.13	20 / 4	2025-11-26
0.1.12	20 / 4	2025-11-20
0.1.11	20 / 4	2025-11-18
0.1.10	20 / 4	2025-11-18
0.1.9	20 / 4	2025-11-18
0.1.8	20 / 4	2025-11-17
0.1.7	20 / 4	2025-11-17
0.1.6	20 / 4	2025-11-16
0.1.5	20 / 4	2025-11-16
0.1.4	20 / 4	2025-11-16
0.1.3	20 / 4	2025-11-16
0.1.2	20 / 4	2025-11-16
0.1.1	20 / 4	2025-11-05
0.1.0	20 / 4	2025-11-05

v0.19.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.17.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: martinsapo.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.