@plone/mockup
A collection of client side patterns for faster and easier web development
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:dropzone | AI (dependencies): dropzone 5.9.3 is a well-known file upload library; stable dependency for this package. | ai | |
| dependencies | unvetted-dep:select2 | AI (dependencies): Git-pinned select2 at a specific tag; stable known dependency for this package. | ai | |
| phantom-deps | phantom-dep:jquery.browser | AI (phantom-deps): Config-file reference only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:bootstrap-icons | AI (phantom-deps): Config-file reference only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:tinymce-i18n | AI (phantom-deps): Referenced in config files as documented; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:cs-jqtree-contextmenu | AI (phantom-deps): Config-file reference only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@11ty/eleventy-upgrade-help | AI (phantom-deps): Config-file reference only; stable false positive for this package. | ai | |
| source-diff | net-exec-file:dist/chunks/32041.18093f6262e2f58cd66d.min.js | AI (source-diff): Webpack chunk for pat-code-editor; dynamic imports are lazy-load patterns for highlight.js languages, not dropper behavior. | ai | |
| npm-metadata | url-dep:select2 | AI (npm-metadata): Pinned to a specific commit hash on the official ivaynberg/select2 repo; documented in package.json comments as intentional pnpm workaround. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Applies a local patch file to select2; no network fetch, no arbitrary code execution — stable pattern for this package. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 5.6.4 | 34 / 15 | |
| 5.6.3 | 34 / 15 | |
| 5.6.2 | 34 / 15 | |
| 5.4.9 | 34 / 15 | |
| 5.4.8 | 34 / 15 |
v5.6.4
2 findingsNewly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.6.2
2 findingsScript: patch --forward node_modules/select2/select2.js < patches/select2.patch || true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.4.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.