@radix-ui/react-focus-guards
This is an internal utility, not intended for public usage.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate transition to GitHub Actions CI/CD publishing for radix-ui org. | ai | |
| provenance | missing-githead | AI (provenance): Expected when switching to GitHub Actions publish with SLSA provenance. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): npm-workos is the WorkOS org account; radix-ui is now under WorkOS. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Previous individual maintainers replaced by org account; legitimate transition. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Radix UI scoped package; missing description is cosmetic, not malicious. | ai | |
| bogus-package | bogus-package | AI (bogus-package): 60M downloads, 17 dep edges; low-value heuristics are false positives here. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 1.1.6 | 0 / 7 | |
| 1.1.5 | 0 / 7 | |
| 1.1.4 | 0 / 7 | |
| 1.1.3 | 0 / 9 | |
| 1.1.2 | 0 / 8 | |
| 1.1.1 | 0 / 0 | |
| 1.1.0 | 0 / 0 | |
| 1.0.1 | 1 / 0 | |
| 1.0.0 | 1 / 0 |
v1.1.6
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.1.5
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v1.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.