@pisell/materials
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:lucide-react | AI (phantom-deps): lucide-react is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| source-diff | obfuscated-file:build/lowcode/render/default/async/view.js | AI (source-diff): Identical webpack bundle pattern; minified build artifact, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:build/lowcode/async/view.js | AI (source-diff): Standard webpack bundle output; readable AWS SDK serialization code, not obfuscation. | ai | |
| provenance | missing-githead | AI (provenance): Mature, high-volume package with known maintainer; missing gitHead is a CI environment change, not a malware signal. | ai | |
| source-diff | obfuscated-file:es/components/PisellContactBrief/components/ContactFormModal.js | AI (source-diff): Standard Babel/regenerator transpiled output; not malicious obfuscation for this component library. | ai | |
| source-diff | obfuscated-file:es/components/PisellCards/components/GraphicTextCard/GraphicTextCard.stories.js | AI (source-diff): Standard Babel/regenerator transpiled output; not malicious obfuscation for this component library. | ai | |
| source-diff | obfuscated-file:es/components/hardwareErrorTip/demo.js | AI (source-diff): Babel/regenerator-runtime transpiler output, not obfuscation; stable for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All three new deps are established React ecosystem packages; no malware indicators. | ai | |
| source-diff | obfuscated-file:build/lowcode/render/default/1.js | AI (source-diff): Standard webpack bundle output (webpackJsonpBaseMaterials); minified build artifact, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:build/lowcode/3.js | AI (source-diff): Standard webpack bundle output (webpackJsonpBaseMaterials); minified build artifact, not malicious obfuscation. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is a best-practice recommendation, not a security blocker for established packages. | ai | |
| source-diff | obfuscated-file:es/components/pisellToast/squareToast/renderImperatively.js | AI (source-diff): Babel-transpiled output (regenerator-runtime); standard build artifact, not obfuscation. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Active UI component library with 1644 versions; incremental source file additions are expected and consistent with its release history. | ai | |
| source-diff | obfuscated-file:es/components/dataSourceComponents/dataSourceForm/urlUtils.js | AI (source-diff): File is Babel-transpiled ES module output (contains regenerator-runtime MIT header, @babel/helpers patterns). Long lines are a build artifact, not obfuscation. This package ships compiled ES modules as its distribution format. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established internal component library (1627 versions); minimal metadata is consistent with organizational tooling, not spam. | ai | |
| source-diff | obfuscated-file:es/components/pisellRecordBoard/shellFrame/Calendar/BookingCalendar.js | AI (source-diff): File contains standard Babel-transpiled ES5 output (canonical helpers: _typeof, _objectSpread, _regeneratorRuntime). Long lines are minified compiled output, not malicious obfuscation. Normal for a React component library shipping compiled artifacts. | ai | |
| source-diff | obfuscated-file:es/components/pisellRecordBoard/shellFrame/Calendar/BookingCalendarDemo.js | AI (source-diff): File contains standard Babel-transpiled/bundled React component output with recognizable helpers (regeneratorRuntime, _typeof). Long lines are from bundling, not intentional obfuscation. Consistent with this UI component library's build pattern. | ai | |
| dependencies | unvetted-dep:@react-spring/web | AI (dependencies): @react-spring/web is a well-known, widely-used React animation library. Its use in a UI component library is expected and benign. | ai | |
| phantom-deps | phantom-dep:antd-mobile | AI (phantom-deps): antd-mobile is a legitimate declared dependency referenced in config files; phantom-dep finding is a packaging style issue, not a security concern. | ai |
Versions (showing 100 of 275)
| Version | Deps | Published |
|---|---|---|
| 6.11.45 | 30 / 45 | |
| 6.11.44 | 30 / 45 | |
| 6.11.42 | 30 / 45 | |
| 6.11.41 | 30 / 45 | |
| 6.11.39 | 30 / 45 | |
| 6.11.38 | 30 / 45 | |
| 6.11.37 | 31 / 45 | |
| 6.11.36 | 31 / 45 | |
| 6.11.35 | 31 / 45 | |
| 6.11.34 | 31 / 45 | |
| 6.11.33 | 31 / 45 | |
| 6.11.32 | 31 / 45 | |
| 6.11.31 | 31 / 45 | |
| 6.11.30 | 31 / 45 | |
| 6.11.29 | 31 / 45 | |
| 6.11.28 | 31 / 45 | |
| 6.11.27 | 31 / 45 | |
| 6.11.20 | 30 / 41 | |
| 6.11.19 | 30 / 41 | |
| 6.11.18 | 30 / 41 | |
| 6.11.3 | 29 / 41 | |
| 6.11.2 | 29 / 41 | |
| 6.11.1 | 29 / 41 | |
| 6.9.5 | 29 / 41 | |
| 6.8.19 | 29 / 40 | |
| 6.8.18 | 29 / 40 | |
| 6.8.17 | 29 / 40 | |
| 6.8.13 | 29 / 40 | |
| 6.6.18 | 29 / 24 | |
| 6.6.17 | 29 / 24 | |
| 6.6.16 | 29 / 24 | |
| 6.6.1 | 29 / 24 | |
| 6.5.9 | 29 / 24 | |
| 6.5.8 | 29 / 24 | |
| 6.5.7 | 29 / 24 | |
| 6.4.17 | 29 / 24 | |
| 6.4.16 | 29 / 24 | |
| 6.4.15 | 29 / 24 | |
| 6.4.14 | 29 / 24 | |
| 6.4.8 | 28 / 24 | |
| 6.4.7 | 28 / 24 | |
| 6.3.46 | 27 / 45 | |
| 6.3.45 | 27 / 45 | |
| 6.3.44 | 27 / 45 | |
| 6.3.43 | 27 / 45 | |
| 6.3.42 | 27 / 45 | |
| 6.3.41 | 27 / 45 | |
| 6.3.40 | 27 / 45 | |
| 6.3.38 | 27 / 45 | |
| 6.3.31 | 26 / 41 | |
| 6.3.30 | 26 / 41 | |
| 6.3.29 | 26 / 41 | |
| 6.3.24 | 26 / 40 | |
| 6.3.22 | 26 / 24 | |
| 6.3.11 | 26 / 24 | |
| 6.3.9 | 26 / 24 | |
| 6.3.8 | 26 / 24 | |
| 6.3.4 | 25 / 24 | |
| 6.3.3 | 25 / 24 | |
| 6.3.1 | 25 / 24 | |
| 6.2.40 | 28 / 24 | |
| 6.2.39 | 27 / 24 | |
| 6.2.38 | 27 / 24 | |
| 6.2.36 | 27 / 24 | |
| 6.2.26 | 25 / 24 | |
| 6.2.25 | 25 / 24 | |
| 6.2.24 | 25 / 24 | |
| 6.1.5 | 26 / 24 | |
| 6.1.4 | 26 / 24 | |
| 6.1.3 | 25 / 25 | |
| 6.1.2 | 25 / 24 | |
| 6.1.1 | 25 / 24 | |
| 6.0.22 | 25 / 24 | |
| 6.0.21 | 25 / 24 | |
| 6.0.20 | 25 / 24 | |
| 6.0.19 | 21 / 24 | |
| 6.0.18 | 21 / 24 | |
| 6.0.17 | 21 / 24 | |
| 6.0.16 | 21 / 24 | |
| 6.0.15 | 21 / 24 | |
| 6.0.14 | 21 / 24 | |
| 6.0.13 | 21 / 22 | |
| 6.0.12 | 21 / 22 | |
| 6.0.11 | 21 / 22 | |
| 6.0.10 | 21 / 22 | |
| 6.0.9 | 21 / 22 | |
| 6.0.8 | 21 / 22 | |
| 6.0.7 | 21 / 22 | |
| 6.0.6 | 21 / 22 | |
| 6.0.5 | 21 / 22 | |
| 6.0.4 | 21 / 22 | |
| 6.0.3 | 21 / 22 | |
| 6.0.2 | 21 / 22 | |
| 6.0.1 | 21 / 22 | |
| 3.3.109 | 28 / 45 | |
| 3.3.108 | 28 / 45 | |
| 3.3.105 | 27 / 41 | |
| 3.3.104 | 27 / 41 | |
| 3.3.103 | 27 / 41 | |
| 3.3.102 | 27 / 41 |
v6.6.18
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (xiangfeng.xue) than the most recent previously approved version (zhiwei.wang) on 2026-07-09, but xiangfeng.xue is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v6.3.46
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.44
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.109
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: zhiwei.wang.
v3.3.108
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jinglin.tan) than the most recent previously approved version (zsj1037797769) on 2026-07-07, but jinglin.tan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.3.105
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (ah-sc) than the most recent previously approved version (jinglin.tan) on 2026-07-06, but ah-sc is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.3.104
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.103
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.3.102
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.