@reach/menu-button
Accessible React button dropdown menu.
51
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ryanflorencemjacksonchancestricklandblainekasten
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Build tooling changed to tsdx in this version; missing gitHead is a side effect of the new build environment, not an indicator of tampering. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): prop-types is a canonical React ecosystem package; adding it as a runtime dep for a React UI component is entirely expected and benign. | ai | |
| provenance | publisher-changed | AI (provenance): ryanflorence and mjackson are co-founders of the same org (Remix/React Training); this is a documented internal maintainer transition, not a compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): mjackson is a well-known, long-standing collaborator in the same org as ryanflorence; addition is a legitimate internal handoff. | ai | |
| provenance | no-provenance | AI (provenance): Reach UI predates provenance attestation; no provenance is expected for this package's era. | ai | |
| bogus-package | bogus-package | AI (bogus-package): chancestrickland is the legitimate maintainer of @reach/* with 1775 approved packages; spam flag is a false positive. | ai | |
| email-domain | unclaimed-email:ryanflorence | AI (email-domain): The 'email' field contains a Twitter handle (@ryanflorence), not a real email address. No actual domain hijacking risk; publisher identity is well-established across 1352 approved packages. | ai | |
| phantom-deps | phantom-dep:warning | AI (phantom-deps): The 'warning' package is a legitimate runtime dep used in React ecosystem packages; phantom-dep flag is a minor packaging artifact, not a security concern. | ai |
Versions (showing 51 of 67)
| Version | Deps | Published |
|---|---|---|
| 0.18.0 | 4 / 7 | |
| 0.17.0 | 6 / 3 | |
| 0.16.2 | 6 / 3 | |
| 0.16.1 | 6 / 3 | |
| 0.16.0 | 6 / 3 | |
| 0.15.3 | 6 / 2 | |
| 0.15.2 | 7 / 2 | |
| 0.15.1 | 7 / 2 | |
| 0.15.0 | 6 / 2 | |
| 0.14.0 | 6 / 2 | |
| 0.13.2 | 6 / 2 | |
| 0.13.1 | 6 / 2 | |
| 0.13.0 | 6 / 0 | |
| 0.12.1 | 6 / 0 | |
| 0.12.0 | 6 / 0 | |
| 0.11.2 | 6 / 0 | |
| 0.11.1 | 6 / 0 | |
| 0.11.0 | 6 / 0 | |
| 0.10.5 | 6 / 0 | |
| 0.10.4 | 6 / 0 | |
| 0.10.3 | 6 / 0 | |
| 0.10.2 | 6 / 0 | |
| 0.10.1 | 6 / 0 | |
| 0.10.0 | 7 / 0 | |
| 0.9.1 | 7 / 0 | |
| 0.9.0 | 7 / 0 | |
| 0.8.6 | 7 / 0 | |
| 0.8.5 | 7 / 0 | |
| 0.8.4 | 7 / 0 | |
| 0.8.3 | 7 / 0 | |
| 0.8.2 | 7 / 0 | |
| 0.8.0 | 5 / 0 | |
| 0.7.4 | 5 / 0 | |
| 0.7.3 | 5 / 0 | |
| 0.7.2 | 5 / 0 | |
| 0.7.1 | 5 / 0 | |
| 0.7.0 | 5 / 0 | |
| 0.6.4 | 7 / 0 | |
| 0.6.3 | 7 / 0 | |
| 0.6.2 | 7 / 0 | |
| 0.6.1 | 7 / 4 | |
| 0.5.4 | 7 / 4 | |
| 0.5.3 | 7 / 4 | |
| 0.5.0 | 7 / 4 | |
| 0.4.0 | 7 / 4 | |
| 0.3.0 | 7 / 4 | |
| 0.1.18 | 6 / 4 | |
| 0.1.17 | 6 / 4 | |
| 0.1.16 | 6 / 5 | |
| 0.1.15 | 6 / 5 | |
| 0.1.14 | 6 / 4 |