← Home

@radix-ui/react-use-rect

npm Repository Homepage
3
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

hadihallakchancestricklandmark-workosnpm-workos

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Legitimate Radix UI org transition to chancestrickland (WorkOS); stable for this package. ai
maintainer-change maintainer-added AI (maintainer-change): Known Radix UI team restructuring; chancestrickland and mark-workos are WorkOS maintainers. ai
maintainer-change maintainer-removed AI (maintainer-change): Previous maintainers replaced as part of known Radix UI org transition. ai
publish-pattern dormant-publish AI (publish-pattern): Radix UI primitives publish in batches; dormancy reflects release cadence, not takeover. ai
provenance no-provenance AI (provenance): Established Radix UI package with 50M+ weekly downloads; lack of provenance is a known gap for this publisher, not a security risk. ai
dependencies unvetted-dep:@radix-ui/rect AI (dependencies): @radix-ui/rect is a sibling package from the same radix-ui/primitives monorepo; dependency is expected and benign. ai
npm-metadata no-description AI (npm-metadata): Radix UI scoped packages routinely omit descriptions; this is a stable pattern across the monorepo, not a malice indicator. ai

Versions (showing 3 of 3)

Version Deps Published
1.1.2 1 / 7
1.1.1 1 / 8
1.1.0 1 / 0

v1.1.2

3 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: chancestrickland → GitHub Actions (on 2026-06-06) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2026-06-06. This could indicate a legitimate maintainer transition or an account compromise.

v1.1.1

2 findings
HIGH Publisher changed: vladmoroz → chancestrickland (on 2025-04-08) provenance

This version was published by a different npm account than previous versions on 2025-04-08. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.