← Home

@necto-react/hooks

npm Repository Homepage

Necto's standard library for providing utility hooks for React applications.

5
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

botond-szabocorinvo-release-bot

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@necto/id AI (dependencies): @necto/id is a workspace sibling in the same Necto monorepo; stable false positive for this package. ai
phantom-deps phantom-dep:react-aria AI (phantom-deps): react-aria is a declared runtime dependency; phantom-dep heuristic fires but it is legitimately used in this hooks library. ai
phantom-deps phantom-dep:@necto/id AI (phantom-deps): Internal @necto/* dep referenced in config; stable false positive for this monorepo package. ai
phantom-deps phantom-dep:@necto/mergers AI (phantom-deps): Internal @necto/* dep referenced in config; stable false positive for this monorepo package. ai
phantom-deps phantom-dep:defu AI (phantom-deps): Monorepo config-file reference; not a real phantom dep for this package. ai
phantom-deps phantom-dep:@necto/platform AI (phantom-deps): Internal @necto/* dep referenced in config; stable false positive for this monorepo package. ai
phantom-deps phantom-dep:@necto/strings AI (phantom-deps): Internal @necto/* dep referenced in config; stable false positive for this monorepo package. ai
phantom-deps phantom-dep:std-env AI (phantom-deps): Monorepo config-file reference; not a real phantom dep for this package. ai

Versions (showing 5 of 5)

Version Deps Published
2.20.0 9 / 0
2.19.2 9 / 0
2.14.15 11 / 8
2.13.0 11 / 8
2.12.6 10 / 8

v2.20.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.19.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.12.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.