← Home

@nvidia-elements/core

npm Repository Homepage

The Design Language for AI/ML Factories Building at the Speed of Light. Provides a set of accessible and themeable UI elements.

8
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

crylanjyanarella

Keywords

web-componentsdesign-systemui-components

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped NVIDIA UI component package; 'core' vs 'cors' is coincidental Levenshtein proximity, not impersonation. ai
install-scripts install-script:postinstall AI (install-scripts): Benign local postinstall.mjs with || exit 0 guard; no network fetch; consistent with component library setup. ai

Versions (showing 8 of 8)

Version Deps Published
0.2.4 3 / 23
0.2.3 3 / 23
0.2.2 3 / 23
0.2.1 3 / 23
0.2.0 3 / 23
0.1.4 3 / 23
0.1.2 3 / 23
0.0.11 3 / 23

v0.2.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.1

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@nvidia-elements/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.0

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@nvidia-elements/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.4

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@nvidia-elements/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.2

3 findings
HIGH Package has 'postinstall' script install-scripts

Script: node postinstall.mjs || exit 0

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@nvidia-elements/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.