@sassoftware/va-report-components
The SAS Visual Analytics SDK is a set of JavaScript APIs and web components that enable SAS Visual Analytics report content to be easily embedded in a third-party application or web page.
5
Versions
SEE LICENSE IN LICENSE
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jefurbeedevakumaraswamyckedwardsrbtleveybrmorrbjtomlinjolynamtlsmcmtlstgryanauldsaskenjacksonmtlhmomartin-coutts-sasromacftimothy.crider-sasdaarthewsken_sassemioticroboticmtlcmcmtlnshtom-mceachan_sasinst
Keywords
SASViyaVisualAnalyticsVASDKVASDKva-sdkVA-SDKreportcomponent
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit TypeScript runtime dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:redux-observable | AI (phantom-deps): Same bundled-output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@tanstack/react-query | AI (phantom-deps): Same bundled-output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:react-focus-lock | AI (phantom-deps): Bundled component library; deps consumed in compiled output, not as direct ES imports. | ai | |
| phantom-deps | phantom-dep:react-dnd-html5-backend | AI (phantom-deps): Same bundled-output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@redux-devtools/extension | AI (phantom-deps): Same bundled-output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@tanstack/react-virtual | AI (phantom-deps): Same bundled-output pattern; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:reselect | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:cldr-core | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react-dnd | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:classnames | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:memoize-one | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react-popper | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:use-memo-one | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:framer-motion | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react-cropper | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react-i18next | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:@popperjs/core | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react-redux | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:redux | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:i18next | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai | |
| phantom-deps | phantom-dep:polished | AI (phantom-deps): Bundled package; deps compiled into dist artifacts, not directly imported in analyzable source. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 2.36.0 | 27 / 0 | |
| 2.35.0 | 27 / 0 | |
| 2.34.1 | 27 / 0 | |
| 2.34.0 | 27 / 0 | |
| 2.33.1 | 27 / 0 |
v2.36.0
2 findings
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
INFO
Publisher changed: brmorr → ckedwards (on 2026-07-17, known maintainer)
provenance
This version was published by a different npm account (ckedwards) than the most recent previously approved version (brmorr) on 2026-07-17, but ckedwards is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.