← Home

@pisell/date-picker

npm
11
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

wang_hanzsj1037797769zhiwei.wangxiangfeng.xueah-scjinglin.tanjinhui02

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff large-new-source-files AI (source-diff): Actively developed UI component library; new source files reflect feature additions, not injected code. ai
maintainer-change maintainer-removed AI (maintainer-change): Active multi-maintainer package; maintainer rotation is expected across 161 versions. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainers yaoxiaojia and larry_ranhejun added alongside known publisher jinglin.tan; consistent with team expansion, not takeover. ai
bogus-package bogus-package AI (bogus-package): @pisell/date-picker is an established internal component library with 159 versions; missing README/repo metadata is a quality issue, not a security concern. ai
dependencies unvetted-dep:@mui/base AI (dependencies): @mui/base is a well-known MUI library; beta version is expected for a date-picker component built on MUI ecosystem. Stable false positive for this package. ai
phantom-deps phantom-dep:react-dom AI (phantom-deps): react-dom is declared as a runtime dep for UI component library consumers; not directly imported in source is expected for this type of package. ai
phantom-deps phantom-dep:@emotion/styled AI (phantom-deps): MUI-based component libraries commonly declare @emotion/styled as a dependency without directly importing it in every source file. ai
phantom-deps phantom-dep:@emotion/react AI (phantom-deps): MUI-based component libraries commonly declare @emotion/react as a dependency without directly importing it in every source file. ai

Versions (showing 11 of 11)

Version Deps Published
3.0.8 14 / 2
1.0.144 14 / 6
1.0.143 14 / 6
1.0.130 14 / 6
1.0.128 14 / 6
1.0.127 14 / 2
1.0.124 14 / 2
1.0.120 14 / 2
1.0.118 14 / 2
1.0.117 14 / 2
1.0.116 14 / 2

v3.0.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.144

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zsj1037797769 → jinglin.tan (on 2026-06-01, known maintainer) provenance

This version was published by a different npm account (jinglin.tan) than the most recent previously approved version (zsj1037797769) on 2026-06-01, but jinglin.tan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.0.143

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.130

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zsj1037797769 → ah-sc (on 2026-02-02, known maintainer) provenance

This version was published by a different npm account (ah-sc) than the most recent previously approved version (zsj1037797769) on 2026-02-02, but ah-sc is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v1.0.127

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.124

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.120

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.118

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.117

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.116

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.