@strapi/admin
Strapi Admin
15
Versions
SEE LICENSE IN LICENSE
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
pierreburgyaurelsicokoalexandrebodinconvlynico-strapistrapi.adzouzcache-your-dreamsbaronvoninternetmarc-roig-strapijhoward1994bassel17
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/_chunks/AuthenticatedApp-VeEtpPSd.js | AI (source-diff): Standard bundled build output for Strapi admin; not obfuscated. | ai | |
| source-diff | obfuscated-file:dist/_chunks/HomePage-CQ6qFlEc.js | AI (source-diff): Standard bundled build output for Strapi admin; not obfuscated. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Active Strapi org regularly adds team members; no suspicious pattern given stable package history. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): motion is the Framer Motion library; legitimate UI animation dep for Strapi admin panel. | ai | |
| provenance | publisher-changed | AI (provenance): alexandrebodin is a long-standing Strapi org publisher; team rotation is expected. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Major version bump with new SVG illustration assets and restructured dist; expected. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-sso-illustration-light.jpg.js | AI (source-diff): Base64-encoded JPEG image asset exported as JS module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-audit-logs-illustration-dark.jpg.mjs | AI (source-diff): ESM variant of same base64 JPEG asset; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-audit-logs-illustration-light.jpg.mjs | AI (source-diff): ESM variant of same base64 JPEG asset; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-content-history-illustration-dark.jpg.mjs | AI (source-diff): ESM variant of same base64 JPEG asset; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-content-history-illustration-light.jpg.mjs | AI (source-diff): ESM variant of same base64 JPEG asset; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-sso-illustration-dark.jpg.mjs | AI (source-diff): ESM variant of same base64 JPEG asset; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-audit-logs-illustration-dark.jpg.js | AI (source-diff): Base64-encoded JPEG image asset exported as JS module; standard bundler output for Strapi admin UI. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-audit-logs-illustration-light.jpg.js | AI (source-diff): Base64-encoded JPEG image asset exported as JS module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-content-history-illustration-dark.jpg.js | AI (source-diff): Base64-encoded JPEG image asset exported as JS module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-content-history-illustration-light.jpg.js | AI (source-diff): Base64-encoded JPEG image asset exported as JS module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-sso-illustration-dark.jpg.js | AI (source-diff): Base64-encoded JPEG image asset exported as JS module; standard bundler output. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/pages/Settings/assets/purchase-page-sso-illustration-light.jpg.mjs | AI (source-diff): ESM variant of same base64 JPEG asset; standard bundler output. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Large monorepo package; incremental source file additions are expected across minor releases. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/assets/images/free-trial.png.mjs | AI (source-diff): Base64-inlined PNG image asset, ESM variant of the same bundled image. | ai | |
| source-diff | obfuscated-file:dist/admin/admin/src/assets/images/free-trial.png.js | AI (source-diff): Base64-inlined PNG image asset, standard bundler output for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Large Strapi monorepo package with 2267 versions; publication gaps are normal for this project. Change is a benign translation file addition with no behavioral impact. | ai | |
| dependencies | unvetted-dep:koa-passport | AI (dependencies): koa-passport is the standard Passport.js middleware for Koa; expected in Strapi's server-side auth stack. | ai | |
| dependencies | unvetted-dep:codemirror5 | AI (dependencies): codemirror5 is a well-known code editor library aliased to codemirror@^5.65.11; legitimate use in a CMS admin panel. | ai | |
| dependencies | unvetted-dep:react-query | AI (dependencies): react-query 3.39.3 is a widely-used data fetching library; legitimate dependency for a React admin panel. | ai | |
| dependencies | unvetted-dep:koa2-ratelimit | AI (dependencies): koa2-ratelimit is a standard rate-limiting middleware for Koa; expected in Strapi's server stack. | ai | |
| dependencies | unvetted-dep:passport-local | AI (dependencies): passport-local is the canonical local authentication strategy for Passport.js; expected in Strapi's auth stack. | ai | |
| dependencies | unvetted-dep:@strapi/design-system | AI (dependencies): First-party Strapi design system library; legitimate dependency from the same vendor. | ai | |
| dependencies | unvetted-dep:@strapi/icons | AI (dependencies): First-party Strapi icon library; legitimate dependency from the same vendor. | ai | |
| phantom-deps | phantom-dep:react-refresh | AI (phantom-deps): react-refresh is a standard HMR tool used in build config; phantom status is expected for this package. | ai | |
| phantom-deps | phantom-dep:history | AI (phantom-deps): history is a standard React Router dependency referenced in config; phantom status is expected for this admin panel package. | ai | |
| phantom-deps | phantom-dep:esbuild | AI (phantom-deps): esbuild is a declared build tool dependency used as a runtime binary/implicit dep in Strapi's build pipeline; phantom status is expected for this package. | ai | |
| phantom-deps | phantom-dep:react-error-boundary | AI (phantom-deps): react-error-boundary is a standard React utility referenced in config; phantom status is expected for this admin panel package. | ai | |
| phantom-deps | phantom-dep:react-select | AI (phantom-deps): UI component dep; may be loaded via design-system or config. Expected for this package. | ai | |
| phantom-deps | phantom-dep:sift | AI (phantom-deps): Common in Strapi monorepo; declared deps used in config/build contexts, not direct imports. Expected pattern for this package. | ai | |
| phantom-deps | phantom-dep:boxen | AI (phantom-deps): Used in CLI/build tooling context within monorepo. Not a security concern. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Used in CLI tooling context. Expected for Strapi admin package. | ai | |
| phantom-deps | phantom-dep:react-is | AI (phantom-deps): Peer/transitive dep declared for compatibility; standard pattern in React ecosystem packages. | ai | |
| phantom-deps | phantom-dep:pluralize | AI (phantom-deps): Declared dep used in config/build context in Strapi monorepo. Not a security concern. | ai | |
| phantom-deps | phantom-dep:scheduler | AI (phantom-deps): React ecosystem transitive dep declared explicitly for version pinning. Expected pattern. | ai | |
| phantom-deps | phantom-dep:codemirror5 | AI (phantom-deps): Declared as npm alias for codemirror v5; used in config/build context. Expected for Strapi admin. | ai | |
| phantom-deps | phantom-dep:highlight.js | AI (phantom-deps): Used in editor/content tooling context. Expected for CMS admin package. | ai | |
| phantom-deps | phantom-dep:jsonwebtoken | AI (phantom-deps): Auth dependency declared for version pinning; standard for Strapi admin server. | ai | |
| phantom-deps | phantom-dep:react-window | AI (phantom-deps): Virtualization dep declared for version pinning. Expected for Strapi admin UI. | ai | |
| phantom-deps | phantom-dep:sanitize-html | AI (phantom-deps): Content sanitization dep; may be loaded via plugin/config context. Expected for CMS. | ai | |
| phantom-deps | phantom-dep:fast-deep-equal | AI (phantom-deps): Utility dep declared for version pinning. Not a security concern. | ai | |
| phantom-deps | phantom-dep:@testing-library/dom | AI (phantom-deps): Testing utility loaded by framework convention. Expected for packages shipping test utilities. | ai | |
| phantom-deps | phantom-dep:@internationalized/date | AI (phantom-deps): i18n dep declared for version pinning; used via design-system. Expected for Strapi admin. | ai | |
| phantom-deps | phantom-dep:@radix-ui/react-toolbar | AI (phantom-deps): UI primitive dep; may be loaded via design-system. Expected for Strapi admin. | ai | |
| bogus-package | bogus-package | AI (bogus-package): @strapi/admin is a core framework package; short README with no code block is expected as docs live externally. Not a spam indicator. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Build tooling; phantom detection is a false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:cross-env | AI (phantom-deps): Used in test scripts; phantom detection is a false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:execa | AI (phantom-deps): Build tooling dependency; phantom detection is a false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:rimraf | AI (phantom-deps): Build script dependency; phantom detection is a false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Build/CLI tooling dependency; phantom detection is a false positive for this monorepo package. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): Build/CLI tooling dependency in a large monorepo; phantom detection is a false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Established Strapi monorepo package; lack of Sigstore provenance is consistent across all prior versions and is not a risk signal here. | ai |