@reach/rect
Measure React elements position in the DOM
42
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ryanflorencemjacksonchancestricklandblainekasten
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:react | AI (typosquat): @reach/rect is a legitimate Reach UI package; 'rect' means rectangle (getBoundingClientRect), not a typo of 'react'. Published by ryanflorence under the established @reach scope. | ai | |
| typosquat | typosquat.levenshtein:jest | AI (typosquat): @reach/rect is a legitimate scoped package; Levenshtein match to 'jest' is purely coincidental. | ai | |
| typosquat | typosquat.levenshtein:next | AI (typosquat): @reach/rect is a legitimate scoped package; Levenshtein match to 'next' is purely coincidental. | ai | |
| provenance | missing-githead | AI (provenance): Reach UI monorepo likely changed publish tooling; chancestrickland is a long-standing maintainer with strong track record. | ai | |
| bogus-package | bogus-package | AI (bogus-package): chancestrickland has 1794 approved versions across 83 packages; spam flag is a false positive for this publisher. | ai | |
| email-domain | unclaimed-email:ryanflorence | AI (email-domain): The 'email' field contains a Twitter handle (@ryanflorence), not a real email address. Not an exploitable domain hijack vector. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): prop-types is the canonical React prop validation library from the React team; adding it to a React UI component is entirely expected and benign. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): mjackson is the co-founder of the same org as ryanflorence; this is a known legitimate maintainer transition within the @reach/* ecosystem. | ai | |
| provenance | publisher-changed | AI (provenance): ryanflorence and mjackson are co-founders of the same org (Remix/React Training) and co-maintainers of the entire @reach/* ecosystem. This transition is legitimate and stable. | ai |
Versions (showing 42 of 42)
| Version | Deps | Published |
|---|---|---|
| 0.18.0 | 2 / 6 | |
| 0.17.0 | 5 / 2 | |
| 0.16.0 | 5 / 2 | |
| 0.15.3 | 5 / 2 | |
| 0.15.2 | 5 / 2 | |
| 0.15.0 | 5 / 2 | |
| 0.14.0 | 4 / 2 | |
| 0.13.2 | 4 / 2 | |
| 0.13.1 | 4 / 2 | |
| 0.13.0 | 4 / 0 | |
| 0.12.1 | 4 / 0 | |
| 0.12.0 | 4 / 0 | |
| 0.11.2 | 4 / 0 | |
| 0.11.1 | 4 / 0 | |
| 0.11.0 | 4 / 0 | |
| 0.10.5 | 4 / 0 | |
| 0.10.4 | 4 / 0 | |
| 0.10.3 | 4 / 0 | |
| 0.10.2 | 4 / 0 | |
| 0.10.1 | 4 / 0 | |
| 0.10.0 | 4 / 0 | |
| 0.9.0 | 4 / 0 | |
| 0.8.6 | 4 / 0 | |
| 0.8.2 | 3 / 0 | |
| 0.8.0 | 2 / 0 | |
| 0.7.4 | 2 / 0 | |
| 0.7.3 | 2 / 0 | |
| 0.7.2 | 2 / 0 | |
| 0.7.1 | 2 / 0 | |
| 0.7.0 | 2 / 0 | |
| 0.6.2 | 2 / 0 | |
| 0.6.1 | 2 / 0 | |
| 0.5.0 | 2 / 0 | |
| 0.4.0 | 2 / 0 | |
| 0.3.0 | 3 / 0 | |
| 0.2.1 | 2 / 0 | |
| 0.2.0 | 2 / 0 | |
| 0.1.2 | 2 / 0 | |
| 0.1.1 | 2 / 0 | |
| 0.1.0 | 2 / 0 | |
| 0.0.2 | 2 / 0 | |
| 0.0.1 | 2 / 0 |