@ottocode/web-sdk
Reusable React components, hooks, and utilities for building ottocode web interfaces
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@ottocode/themes | AI (dependencies): First-party @ottocode monorepo package, versioned in lockstep; stable false positive for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Actively developed UI SDK; incremental file additions are expected across its 119-version history. | ai | |
| source-diff | obfuscated-file:dist/components/tunnel/TunnelSidebar.js | AI (source-diff): File is readable tsc-compiled React output; long lines are normal for bundled JSX, not obfuscation. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are established @codemirror/* packages; consistent with adding CodeMirror editor support. | ai | |
| dependencies | unvetted-dep:ghostty-web | AI (dependencies): ghostty-web is a WebAssembly terminal emulator; its use in a web SDK is plausible and no malicious signals are associated with it. Acceptable for this package. | ai | |
| dependencies | unvetted-dep:@ottocode/sdk | AI (dependencies): Sibling package in the same @ottocode monorepo, pinned to the same version. Consistent with coordinated monorepo releases by the same publisher. | ai | |
| provenance | no-provenance | AI (provenance): Young private-ecosystem package; lack of provenance is common (~88% of npm) and not a security signal for this package. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): axios is a declared runtime dependency; phantom-dep finding reflects it being referenced in config rather than directly imported — a packaging style choice, not a security issue. | ai |
Versions (showing 51 of 151)
| Version | Deps | Published |
|---|---|---|
| 0.1.224 | 6 / 14 | |
| 0.1.223 | 6 / 14 | |
| 0.1.222 | 6 / 14 | |
| 0.1.221 | 6 / 14 | |
| 0.1.220 | 6 / 14 | |
| 0.1.219 | 6 / 14 | |
| 0.1.218 | 6 / 14 | |
| 0.1.217 | 6 / 14 | |
| 0.1.216 | 6 / 14 | |
| 0.1.215 | 6 / 14 | |
| 0.1.213 | 6 / 14 | |
| 0.1.212 | 6 / 14 | |
| 0.1.211 | 6 / 14 | |
| 0.1.210 | 6 / 14 | |
| 0.1.209 | 6 / 14 | |
| 0.1.208 | 6 / 14 | |
| 0.1.207 | 6 / 14 | |
| 0.1.206 | 6 / 14 | |
| 0.1.205 | 6 / 14 | |
| 0.1.204 | 6 / 14 | |
| 0.1.203 | 6 / 14 | |
| 0.1.202 | 6 / 14 | |
| 0.1.201 | 6 / 14 | |
| 0.1.200 | 6 / 14 | |
| 0.1.199 | 6 / 14 | |
| 0.1.198 | 6 / 14 | |
| 0.1.197 | 6 / 14 | |
| 0.1.196 | 6 / 14 | |
| 0.1.195 | 6 / 14 | |
| 0.1.194 | 6 / 14 | |
| 0.1.193 | 6 / 14 | |
| 0.1.192 | 6 / 14 | |
| 0.1.191 | 6 / 14 | |
| 0.1.190 | 6 / 14 | |
| 0.1.189 | 6 / 14 | |
| 0.1.188 | 6 / 14 | |
| 0.1.187 | 6 / 14 | |
| 0.1.186 | 6 / 14 | |
| 0.1.185 | 6 / 14 | |
| 0.1.184 | 6 / 14 | |
| 0.1.183 | 6 / 14 | |
| 0.1.182 | 6 / 14 | |
| 0.1.181 | 6 / 14 | |
| 0.1.180 | 6 / 14 | |
| 0.1.179 | 6 / 14 | |
| 0.1.178 | 6 / 14 | |
| 0.1.177 | 6 / 14 | |
| 0.1.176 | 6 / 14 | |
| 0.1.175 | 6 / 14 | |
| 0.1.174 | 6 / 14 | |
| 0.1.173 | 6 / 14 |
v0.1.223
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.220
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.218
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.216
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.215
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.213
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.212
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.211
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.198
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.197
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.196
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.195
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.194
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.189
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.