@reach/observe-rect
Observe the Rect of a DOM element.
8
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
blainekastenchancestricklandmjacksonryanflorence
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from ryanflorence to chancestrickland is a documented, legitimate handoff within React Training / Reach UI org. chancestrickland is the known long-term Reach UI maintainer. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): chancestrickland and mjackson (Michael Jackson) are both React Training co-founders/core maintainers. Addition is a legitimate organizational change, not a compromise. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects migration to tsdx build tooling producing CJS, ESM, and UMD bundles. Multiple output formats naturally explain the 4.7x size increase. | ai | |
| provenance | missing-githead | AI (provenance): Missing gitHead is consistent with the tsdx tooling migration changing the publish environment. No malicious indicator. | ai | |
| email-domain | unclaimed-email:ryanflorence | AI (email-domain): The 'email' field contains '@ryanflorence', a social handle placeholder, not a real email address. No actual email domain to hijack; finding is a false positive for this package. | ai |