@muraldevkit/ui-toolkit
Mural's UI Toolkit
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Build tooling expansion (rollup/webpack/tsc configs) for an established design-system package, not injected code. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Corresponds to same build pipeline expansion; no malicious payload evidence. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): lodash.uniqueid is a small, well-known utility; not a supply-chain concern here. | ai | |
| phantom-deps | phantom-dep:lodash.isequal | AI (phantom-deps): Declared as runtime dep; phantom-dep heuristic fires because direct import not detected, but usage via config/indirect is expected for this package. | ai | |
| phantom-deps | phantom-dep:lodash.debounce | AI (phantom-deps): Same as lodash.isequal — declared runtime dep, phantom-dep is a false positive for this package. | ai | |
| dependencies | unvetted-dep:@react-spring/web | AI (dependencies): @react-spring/web is a well-established animation library; stable false positive for this UI toolkit. | ai |
Versions (showing 100 of 151)
| Version | Deps | Published |
|---|---|---|
| 4.70.2 | 10 / 78 | |
| 4.70.1 | 10 / 77 | |
| 4.70.0 | 10 / 77 | |
| 4.69.0 | 9 / 70 | |
| 4.68.0 | 9 / 70 | |
| 4.67.0 | 9 / 70 | |
| 4.66.0 | 9 / 72 | |
| 4.65.3 | 9 / 72 | |
| 4.65.2 | 9 / 72 | |
| 4.65.1 | 9 / 72 | |
| 4.65.0 | 9 / 72 | |
| 4.64.0 | 9 / 72 | |
| 4.63.1 | 10 / 73 | |
| 4.63.0 | 10 / 73 | |
| 4.62.2 | 10 / 73 | |
| 4.62.1 | 10 / 73 | |
| 4.62.0 | 10 / 73 | |
| 4.61.4 | 10 / 73 | |
| 4.61.3 | 10 / 73 | |
| 4.61.2 | 10 / 73 | |
| 4.61.1 | 10 / 73 | |
| 4.61.0 | 10 / 73 | |
| 4.60.0 | 10 / 73 | |
| 4.59.1 | 9 / 73 | |
| 4.59.0 | 9 / 73 | |
| 4.58.0 | 9 / 73 | |
| 4.57.0 | 9 / 73 | |
| 4.56.0 | 9 / 73 | |
| 4.55.0 | 9 / 73 | |
| 4.54.0 | 9 / 73 | |
| 4.53.1 | 9 / 73 | |
| 4.53.0 | 9 / 73 | |
| 4.52.4 | 9 / 73 | |
| 4.52.3 | 9 / 73 | |
| 4.52.2 | 9 / 73 | |
| 4.52.1 | 9 / 73 | |
| 4.52.0 | 9 / 73 | |
| 4.51.3 | 9 / 73 | |
| 4.51.2 | 9 / 73 | |
| 4.51.1 | 9 / 73 | |
| 4.51.0 | 9 / 73 | |
| 4.50.1 | 9 / 73 | |
| 4.50.0 | 9 / 73 | |
| 4.49.4 | 9 / 73 | |
| 4.49.3 | 9 / 73 | |
| 4.49.2 | 9 / 73 | |
| 4.49.1 | 9 / 73 | |
| 4.49.0 | 9 / 73 | |
| 4.48.1 | 9 / 73 | |
| 4.48.0 | 9 / 73 | |
| 4.47.7 | 9 / 73 | |
| 4.47.6 | 9 / 73 | |
| 4.47.5 | 9 / 73 | |
| 4.47.4 | 9 / 73 | |
| 4.47.3 | 9 / 73 | |
| 4.47.2 | 9 / 72 | |
| 4.47.1 | 9 / 72 | |
| 4.47.0 | 9 / 72 | |
| 4.46.0 | 9 / 72 | |
| 4.45.2 | 9 / 72 | |
| 4.45.1 | 9 / 72 | |
| 4.45.0 | 9 / 72 | |
| 4.44.1 | 9 / 72 | |
| 4.44.0 | 9 / 71 | |
| 4.43.0 | 9 / 77 | |
| 4.42.0 | 9 / 77 | |
| 4.41.7 | 9 / 77 | |
| 4.41.6 | 9 / 77 | |
| 4.41.5 | 9 / 77 | |
| 4.41.4 | 9 / 77 | |
| 4.41.3 | 9 / 77 | |
| 4.41.2 | 9 / 77 | |
| 4.41.1 | 9 / 77 | |
| 4.41.0 | 9 / 77 | |
| 4.40.0 | 9 / 77 | |
| 4.39.1 | 9 / 77 | |
| 4.39.0 | 9 / 77 | |
| 4.38.0 | 9 / 77 | |
| 4.37.1 | 9 / 77 | |
| 4.37.0 | 9 / 77 | |
| 4.36.1 | 9 / 77 | |
| 4.36.0 | 9 / 77 | |
| 4.35.1 | 9 / 77 | |
| 4.35.0 | 9 / 77 | |
| 4.34.1 | 9 / 77 | |
| 4.34.0 | 9 / 77 | |
| 4.33.3 | 9 / 77 | |
| 4.33.2 | 9 / 77 | |
| 4.33.1 | 9 / 77 | |
| 4.33.0 | 9 / 77 | |
| 4.32.0 | 9 / 77 | |
| 4.31.1 | 9 / 77 | |
| 4.31.0 | 9 / 78 | |
| 4.30.0 | 9 / 78 | |
| 4.29.0 | 9 / 78 | |
| 4.28.0 | 9 / 78 | |
| 4.27.0 | 9 / 78 | |
| 4.26.0 | 8 / 77 | |
| 4.25.1 | 8 / 77 | |
| 4.25.0 | 8 / 77 |
v4.70.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.70.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.70.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.69.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.68.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.67.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.66.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.35.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.34.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.34.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.33.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.33.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.33.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.33.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.32.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.31.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.30.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.29.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.28.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.27.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.