No SLSA provenancenpm registry signaturesgitHead linked
Without SLSA provenance there is no cryptographic link between this
tarball and the public source, so a manually published version cannot
be tied back to a reviewed commit.
Maintainers
devongovettaspro83
Accepted risks
Findings the reviewer chose to accept rather than block on.
Source
Rule
Reason
Accepted by
When
typosquat
typosquat.levenshtein:pg
AI (typosquat): False positive: @react-spectrum/tag is an official Adobe React Spectrum scoped package with no relationship to the 'pg' PostgreSQL client. Name similarity is purely coincidental.
ai
phantom-deps
phantom-dep:@swc/helpers
AI (phantom-deps): @swc/helpers is a known implicit runtime dependency for SWC-compiled packages; its presence in dependencies without direct imports is expected for this build toolchain.
ai
bogus-package
bogus-package
AI (bogus-package): Monorepo sub-packages in adobe/react-spectrum consistently lack keywords and verbose READMEs; these are not spam indicators for this well-established package family.