@ray-js/components MIT 35 versions

@ray-js/components

npm

Ray basic components

35

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

tuyafe

Keywords

ray

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	dormant-publish	AI (publish-pattern): Established Tuya corporate publisher with strong track record; dormancy gap without other indicators is not actionable.	ai	2026/06/06
dependencies	unvetted-dep:hooks	AI (dependencies): Stable dependency in this package across many versions; phantom-dep finding confirms it's a config-level reference.	ai	2026/05/15
dependencies	unvetted-dep:@ray-core/macro	AI (dependencies): Internal @ray-core scoped package consistent with Tuya/Ray ecosystem; stable across versions.	ai	2026/05/15
dependencies	unvetted-dep:@ray-core/wechat	AI (dependencies): Internal @ray-core scoped package consistent with Tuya/Ray ecosystem; stable across versions.	ai	2026/05/15
provenance	no-provenance	AI (provenance): Established Tuya org package; lack of Sigstore provenance is consistent across all versions and not a security risk here.	ai	2026/05/15
phantom-deps	phantom-dep:@ray-core/macro	AI (phantom-deps): Referenced in config files only; stable false positive for this package.	ai	2026/05/15
phantom-deps	phantom-dep:hooks	AI (phantom-deps): Referenced in config files only; stable false positive for this package.	ai	2026/05/15

Versions (showing 35 of 35)

Version	Deps	Published
1.7.71	11 / 1	2026-06-05
1.7.70	11 / 1	2026-04-29
1.7.67	11 / 1	2026-03-31
1.7.66	11 / 1	2026-03-31
1.7.65	11 / 1	2026-03-06
1.7.64	11 / 1	2026-03-05
1.7.63	11 / 1	2026-02-11
1.7.62	11 / 1	2026-02-03
1.7.61	11 / 1	2026-01-30
1.7.60	11 / 1	2026-01-29
1.7.59	11 / 1	2026-01-15
1.7.57	11 / 1	2025-12-04
1.7.56	11 / 1	2025-11-27
1.7.54	11 / 1	2025-11-06
1.7.53	11 / 1	2025-11-04
1.7.51	11 / 1	2025-10-30
1.7.49	11 / 1	2025-10-21
1.7.47	11 / 1	2025-10-21
1.7.40	11 / 1	2025-09-25
1.7.38	11 / 1	2025-09-12
1.7.37	11 / 1	2025-09-08
1.7.34	11 / 1	2025-08-21
1.7.31	11 / 1	2025-08-18
1.7.30	11 / 1	2025-08-12
1.7.27	11 / 1	2025-08-08
1.7.26	11 / 1	2025-08-07
1.7.25	11 / 1	2025-08-04
1.7.23	11 / 1	2025-07-09
1.7.20	11 / 1	2025-07-03
1.7.19	11 / 1	2025-07-03
1.7.16	11 / 1	2025-06-17
1.7.15	11 / 1	2025-06-16
1.7.13	11 / 1	2025-06-10
1.7.12	11 / 1	2025-06-04
1.7.11	11 / 1	2025-05-30

v1.7.71

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.70

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.67

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.66

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.65

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.64

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.63

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.62

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.61

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.60

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.59

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.57

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.56

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.54

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.53

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.51

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.49

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.47

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.40

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.38

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.37

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.34

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.31

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.30

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.27

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.26

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.25

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.7.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.7.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.