@reactionary/core
This library was generated with [Nx](https://nx.dev).
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from manual to GitHub Actions CI/CD with SLSA attestation; provenance direction is IMPROVED, not a risk signal. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped package @reactionary/core vs unscoped cors — edit-distance match is a false positive; different namespace and purpose. | ai | |
| phantom-deps | phantom-dep:vitest | AI (phantom-deps): vitest is listed as a runtime dep but is a dev/test tool; phantom-dep heuristic fires correctly but is a package quality issue, not a security one. | ai | |
| phantom-deps | phantom-dep:@nx/vite | AI (phantom-deps): @nx/vite is a build tool incorrectly listed as runtime dep; same false-positive pattern as vitest. | ai |
Versions (showing 43 of 143)
| Version | Deps | Published |
|---|---|---|
| 0.0.78 | 4 / 0 | |
| 0.0.77 | 4 / 0 | |
| 0.0.76 | 4 / 0 | |
| 0.0.75 | 4 / 0 | |
| 0.0.74 | 4 / 0 | |
| 0.0.73 | 4 / 0 | |
| 0.0.72 | 4 / 0 | |
| 0.0.71 | 4 / 0 | |
| 0.0.70 | 4 / 0 | |
| 0.0.69 | 4 / 0 | |
| 0.0.68 | 4 / 0 | |
| 0.0.67 | 4 / 0 | |
| 0.0.66 | 4 / 0 | |
| 0.0.65 | 4 / 0 | |
| 0.0.64 | 4 / 0 | |
| 0.0.63 | 4 / 0 | |
| 0.0.62 | 4 / 0 | |
| 0.0.61 | 4 / 0 | |
| 0.0.60 | 4 / 0 | |
| 0.0.59 | 4 / 0 | |
| 0.0.58 | 4 / 0 | |
| 0.0.55 | 4 / 0 | |
| 0.0.54 | 4 / 0 | |
| 0.0.53 | 4 / 0 | |
| 0.0.52 | 4 / 0 | |
| 0.0.51 | 4 / 0 | |
| 0.0.48 | 4 / 0 | |
| 0.0.42 | 2 / 0 | |
| 0.0.41 | 2 / 0 | |
| 0.0.40 | 2 / 0 | |
| 0.0.39 | 2 / 0 | |
| 0.0.38 | 3 / 0 | |
| 0.0.37 | 3 / 0 | |
| 0.0.36 | 3 / 0 | |
| 0.0.35 | 3 / 0 | |
| 0.0.34 | 3 / 0 | |
| 0.0.33 | 3 / 0 | |
| 0.0.32 | 3 / 0 | |
| 0.0.31 | 3 / 0 | |
| 0.0.30 | 3 / 0 | |
| 0.0.29 | 3 / 0 | |
| 0.0.28 | 2 / 0 | |
| 0.0.27 | 2 / 0 |
v0.0.51
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.48
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.