← Home

@open-mercato/ui

npm Repository Homepage

Composable UI toolkit for Open Mercato backoffice and business apps.

14
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

pat-lewczukpatryk.andrzejewskipiotrkarwatka

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Fires only in a test file snapshotting process.env for afterEach restoration — standard Jest pattern, not a runtime secret leak. ai
provenance missing-githead AI (provenance): Package has SLSA provenance attestation; missing gitHead is superseded by stronger CI/CD integrity signal. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped package @open-mercato/ui is not a plausible typosquat of qs; Levenshtein match is spurious. ai
typosquat typosquat.levenshtein:uuid AI (typosquat): Scoped package @open-mercato/ui is not a plausible typosquat of uuid; Levenshtein match is spurious. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped package @open-mercato/ui is not a plausible typosquat of yup; Levenshtein match is spurious. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped package @open-mercato/ui is not a plausible typosquat of joi; Levenshtein match is spurious. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @open-mercato/ui is not a plausible typosquat of pg; Levenshtein match is spurious. ai

Versions (showing 14 of 14)

Version Deps Published
0.6.6 20 / 14
0.6.5 20 / 13
0.6.4 20 / 13
0.6.3 15 / 13
0.6.2 15 / 13
0.6.1 15 / 13
0.6.0 14 / 8
0.5.0 10 / 8
0.4.10 6 / 8
0.4.9 6 / 8
0.4.8 6 / 8
0.4.7 6 / 8
0.4.6 7 / 7
0.4.5 7 / 7

v0.6.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.