@pisell/materials
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:lucide-react | AI (phantom-deps): lucide-react is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| source-diff | obfuscated-file:build/lowcode/render/default/async/view.js | AI (source-diff): Identical webpack bundle pattern; minified build artifact, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:build/lowcode/async/view.js | AI (source-diff): Standard webpack bundle output; readable AWS SDK serialization code, not obfuscation. | ai | |
| provenance | missing-githead | AI (provenance): Mature, high-volume package with known maintainer; missing gitHead is a CI environment change, not a malware signal. | ai | |
| source-diff | obfuscated-file:es/components/PisellContactBrief/components/ContactFormModal.js | AI (source-diff): Standard Babel/regenerator transpiled output; not malicious obfuscation for this component library. | ai | |
| source-diff | obfuscated-file:es/components/PisellCards/components/GraphicTextCard/GraphicTextCard.stories.js | AI (source-diff): Standard Babel/regenerator transpiled output; not malicious obfuscation for this component library. | ai | |
| source-diff | obfuscated-file:es/components/hardwareErrorTip/demo.js | AI (source-diff): Babel/regenerator-runtime transpiler output, not obfuscation; stable for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All three new deps are established React ecosystem packages; no malware indicators. | ai | |
| source-diff | obfuscated-file:build/lowcode/render/default/1.js | AI (source-diff): Standard webpack bundle output (webpackJsonpBaseMaterials); minified build artifact, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:build/lowcode/3.js | AI (source-diff): Standard webpack bundle output (webpackJsonpBaseMaterials); minified build artifact, not malicious obfuscation. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is a best-practice recommendation, not a security blocker for established packages. | ai | |
| source-diff | obfuscated-file:es/components/pisellToast/squareToast/renderImperatively.js | AI (source-diff): Babel-transpiled output (regenerator-runtime); standard build artifact, not obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Active UI component library with 1644 versions; incremental source file additions are expected and consistent with its release history. | ai | |
| source-diff | obfuscated-file:es/components/dataSourceComponents/dataSourceForm/urlUtils.js | AI (source-diff): File is Babel-transpiled ES module output (contains regenerator-runtime MIT header, @babel/helpers patterns). Long lines are a build artifact, not obfuscation. This package ships compiled ES modules as its distribution format. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established internal component library (1627 versions); minimal metadata is consistent with organizational tooling, not spam. | ai | |
| source-diff | obfuscated-file:es/components/pisellRecordBoard/shellFrame/Calendar/BookingCalendar.js | AI (source-diff): File contains standard Babel-transpiled ES5 output (canonical helpers: _typeof, _objectSpread, _regeneratorRuntime). Long lines are minified compiled output, not malicious obfuscation. Normal for a React component library shipping compiled artifacts. | ai | |
| source-diff | obfuscated-file:es/components/pisellRecordBoard/shellFrame/Calendar/BookingCalendarDemo.js | AI (source-diff): File contains standard Babel-transpiled/bundled React component output with recognizable helpers (regeneratorRuntime, _typeof). Long lines are from bundling, not intentional obfuscation. Consistent with this UI component library's build pattern. | ai | |
| dependencies | unvetted-dep:@react-spring/web | AI (dependencies): @react-spring/web is a well-known, widely-used React animation library. Its use in a UI component library is expected and benign. | ai | |
| phantom-deps | phantom-dep:antd-mobile | AI (phantom-deps): antd-mobile is a legitimate declared dependency referenced in config files; phantom-dep finding is a packaging style issue, not a security concern. | ai |
Versions (showing 75 of 275)
| Version | Deps | Published |
|---|---|---|
| 3.3.101 | 27 / 41 | |
| 3.3.100 | 27 / 41 | |
| 3.3.99 | 27 / 41 | |
| 3.3.98 | 27 / 41 | |
| 3.3.97 | 27 / 41 | |
| 3.3.96 | 26 / 41 | |
| 3.3.93 | 26 / 41 | |
| 3.3.91 | 26 / 41 | |
| 3.3.90 | 26 / 41 | |
| 3.3.89 | 26 / 41 | |
| 3.3.79 | 26 / 40 | |
| 3.3.74 | 26 / 24 | |
| 3.3.69 | 26 / 24 | |
| 3.3.68 | 26 / 24 | |
| 3.3.67 | 26 / 24 | |
| 3.3.66 | 26 / 24 | |
| 2.2.132 | 28 / 45 | |
| 2.2.131 | 27 / 41 | |
| 2.2.115 | 29 / 24 | |
| 2.2.114 | 29 / 24 | |
| 2.2.113 | 29 / 24 | |
| 2.2.112 | 29 / 24 | |
| 2.2.111 | 29 / 24 | |
| 1.10.6 | 30 / 42 | |
| 1.10.5 | 30 / 42 | |
| 1.10.4 | 30 / 42 | |
| 1.10.3 | 30 / 42 | |
| 1.10.2 | 30 / 42 | |
| 1.10.1 | 30 / 42 | |
| 1.8.61 | 30 / 45 | |
| 1.8.60 | 30 / 45 | |
| 1.8.59 | 30 / 45 | |
| 1.8.58 | 30 / 45 | |
| 1.8.57 | 30 / 45 | |
| 1.8.56 | 30 / 45 | |
| 1.8.55 | 30 / 45 | |
| 1.8.54 | 30 / 45 | |
| 1.8.53 | 30 / 45 | |
| 1.8.52 | 30 / 45 | |
| 1.8.51 | 30 / 45 | |
| 1.8.50 | 30 / 45 | |
| 1.8.49 | 30 / 45 | |
| 1.8.48 | 30 / 45 | |
| 1.8.47 | 30 / 45 | |
| 1.8.46 | 30 / 45 | |
| 1.8.40 | 30 / 45 | |
| 1.8.27 | 30 / 41 | |
| 1.8.26 | 30 / 41 | |
| 1.8.23 | 30 / 41 | |
| 1.8.22 | 30 / 41 | |
| 1.8.21 | 30 / 41 | |
| 1.0.1096 | 31 / 42 | |
| 1.0.1095 | 31 / 42 | |
| 1.0.1094 | 31 / 42 | |
| 1.0.1093 | 31 / 42 | |
| 1.0.1092 | 31 / 42 | |
| 1.0.1091 | 31 / 42 | |
| 1.0.1090 | 31 / 42 | |
| 1.0.1089 | 31 / 42 | |
| 1.0.1088 | 31 / 42 | |
| 1.0.1087 | 31 / 42 | |
| 1.0.1086 | 31 / 42 | |
| 1.0.1085 | 31 / 42 | |
| 1.0.1073 | 31 / 42 | |
| 1.0.1065 | 30 / 38 | |
| 1.0.1009 | 29 / 37 | |
| 1.0.1008 | 29 / 37 | |
| 1.0.1007 | 29 / 37 | |
| 1.0.1006 | 29 / 37 | |
| 1.0.1005 | 29 / 37 | |
| 1.0.963 | 29 / 24 | |
| 1.0.961 | 29 / 24 | |
| 1.0.960 | 29 / 24 | |
| 1.0.959 | 29 / 24 | |
| 1.0.958 | 29 / 24 |
v2.2.132
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.6
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jinglin.tan) than the most recent previously approved version (zhiwei.wang) on 2026-07-27, but jinglin.tan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.10.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.61
3 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: zhiwei.wang.
This version was published by a different npm account (zhiwei.wang) than the most recent previously approved version (jinglin.tan) on 2026-07-08, but zhiwei.wang is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.1096
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jinglin.tan) than the most recent previously approved version (ah-sc) on 2026-07-07, but jinglin.tan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.1095
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1094
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.