@nayhoo/ui
A collection of React components, built with [Radix Primitives](https://www.radix-ui.com/primitives), styled with [vanilla-extract](https://vanilla-extract.style).
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Manual publish variance, no malicious behavior; track record from trusted publisher. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): React peer dependency; common pattern in UI libraries. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Early-stage scoped package; missing metadata is not malicious. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-icons | AI (phantom-deps): Radix UI component library; re-exported in config, not direct import. | ai | |
| source-diff | obfuscated-file:dist/components/dialog.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/components/avatar.js | AI (source-diff): esbuild/tsup bundler banner, readable component source, not real obfuscation. | ai | |
| source-diff | obfuscated-file:dist/components/dropdown-menu.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/components/flex.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/components/grid.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/patterns/index.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/theme/index.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/components/menu.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| source-diff | obfuscated-file:dist/components/tooltip.js | AI (source-diff): Bundler output, matches tsup build script. | ai | |
| dependencies | unvetted-dep:@vanilla-extract/esbuild-plugin | AI (dependencies): @vanilla-extract/esbuild-plugin is a well-known build tool; unvetted flag is a false positive for this package. | ai | |
| dependencies | unvetted-dep:@radix-ui/react-avatar | AI (dependencies): @radix-ui/react-avatar is a well-known Radix UI primitive; unvetted flag is a false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped UI library; name collision with joi is coincidental, not impersonation. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped UI library; name collision with yup is coincidental, not impersonation. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped UI library; name collision with pg is coincidental, not impersonation. | ai | |
| phantom-deps | phantom-dep:@radix-ui/colors | AI (phantom-deps): Design token package used in config/theme files, not direct JS imports. | ai | |
| phantom-deps | phantom-dep:@vanilla-extract/css | AI (phantom-deps): Build-time CSS-in-JS tool; referenced in config, not runtime imports. | ai | |
| phantom-deps | phantom-dep:@vanilla-extract/esbuild-plugin | AI (phantom-deps): Build plugin; used in build config, not runtime imports. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped UI library; name collision with qs is coincidental, not impersonation. | ai | |
| phantom-deps | phantom-dep:tsup | AI (phantom-deps): tsup is a build tool referenced in config/scripts; not imported at runtime. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped UI library; name collision with uuid is coincidental, not impersonation. | ai |
Versions (showing 11 of 11)
| Version | Deps | Published |
|---|---|---|
| 0.20.2 | 20 / 7 | |
| 0.20.1 | 24 / 7 | |
| 0.20.0 | 25 / 7 | |
| 0.19.2 | 25 / 7 | |
| 0.19.1 | 25 / 7 | |
| 0.19.0 | 25 / 7 | |
| 0.3.1 | 14 / 6 | |
| 0.3.0 | 14 / 6 | |
| 0.2.0 | 14 / 4 | |
| 0.1.1 | 14 / 4 | |
| 0.1.0 | 14 / 4 |
v0.19.0
11 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: timkinsman.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: timkinsman.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.