@sanity/icons
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Each icon is a separate file; large file count is inherent to this package's per-icon export structure. | ai | |
| source-diff | obfuscated-file:dist/Bug.js | AI (source-diff): Long lines are SVG path data in generated icon components; stable false positive for this icon package. | ai | |
| provenance | missing-githead | AI (provenance): Expected when publishing via GitHub Actions CI/CD instead of npm CLI directly. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Consolidation to service account (sanity-svc.npm); consistent with org-level npm management. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Package is actively maintained; gap is normal for a stable icon library. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): sanity-svc.npm is Sanity's service account for automated publishing. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI/CD publishing with SLSA provenance; legitimate for @sanity org. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Established Sanity.io scoped package; Levenshtein match to 'cors' is coincidental, not impersonation. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 5.2.1 | 0 / 25 | |
| 5.2.0 | 0 / 44 | |
| 5.1.0 | 0 / 44 | |
| 5.0.0 | 0 / 43 | |
| 4.1.0 | 0 / 42 | |
| 4.0.0 | 0 / 42 | |
| 3.8.0 | 0 / 40 | |
| 3.7.7 | 0 / 32 | |
| 3.7.6 | 0 / 42 | |
| 3.7.4 | 0 / 43 | |
| 3.7.3 | 0 / 43 | |
| 3.7.2 | 0 / 43 | |
| 3.7.1 | 0 / 49 | |
| 3.7.0 | 0 / 52 | |
| 3.6.0 | 0 / 52 | |
| 3.5.7 | 0 / 50 | |
| 3.5.6 | 1 / 51 | |
| 3.5.5 | 1 / 51 | |
| 3.5.4 | 1 / 51 | |
| 3.5.3 | 1 / 51 | |
| 3.5.2 | 1 / 51 | |
| 3.5.1 | 0 / 49 | |
| 3.5.0 | 0 / 50 | |
| 3.4.0 | 0 / 50 | |
| 3.3.1 | 0 / 50 | |
| 3.3.0 | 0 / 50 | |
| 3.2.0 | 0 / 50 | |
| 3.1.0 | 0 / 50 | |
| 3.0.0 | 0 / 50 |
v5.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.1.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v4.0.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v3.8.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v3.7.7
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v3.7.6
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
This version was published by a different npm account than previous versions on 2026-07-01. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.4.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.3.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.