@teambit/code.ui.code-tab-page
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@teambit/component.ui.artifacts.queries.use-component-artifacts | AI (dependencies): Internal @teambit org dependency; consistent with this package's component publishing pattern. | ai | |
| dependencies | unvetted-dep:@teambit/code.ui.code-view | AI (dependencies): Internal @teambit org dependency; consistent with this package's component publishing pattern. | ai | |
| dependencies | unvetted-dep:@teambit/code.ui.code-tab-tree | AI (dependencies): Internal @teambit org dependency; consistent with this package's component publishing pattern. | ai | |
| dependencies | unvetted-dep:@teambit/component.ui.artifacts.artifacts-tree | AI (dependencies): Internal @teambit org dependency; consistent with this package's component publishing pattern. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Teambit component packages routinely omit descriptions; stable false positive for this org. | ai | |
| provenance | no-provenance | AI (provenance): Teambit packages consistently lack provenance attestation; not a risk signal for this publisher. | ai | |
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): core-js is a known implicit polyfill dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:@teambit/ui-foundation.ui.constants.z-indexes | AI (phantom-deps): Same-org teambit package; phantom-dep heuristic misfires on Bit component imports. | ai |
Versions (showing 51 of 64)
| Version | Deps | Published |
|---|---|---|
| 0.0.706 | 22 / 9 | |
| 0.0.705 | 22 / 9 | |
| 0.0.704 | 22 / 9 | |
| 0.0.703 | 22 / 9 | |
| 0.0.702 | 22 / 9 | |
| 0.0.701 | 22 / 9 | |
| 0.0.700 | 22 / 9 | |
| 0.0.699 | 22 / 9 | |
| 0.0.698 | 22 / 9 | |
| 0.0.697 | 22 / 9 | |
| 0.0.696 | 22 / 9 | |
| 0.0.695 | 22 / 9 | |
| 0.0.694 | 22 / 9 | |
| 0.0.693 | 22 / 9 | |
| 0.0.692 | 22 / 9 | |
| 0.0.691 | 22 / 9 | |
| 0.0.690 | 22 / 9 | |
| 0.0.689 | 22 / 9 | |
| 0.0.688 | 22 / 9 | |
| 0.0.687 | 22 / 9 | |
| 0.0.686 | 22 / 9 | |
| 0.0.685 | 22 / 9 | |
| 0.0.684 | 22 / 9 | |
| 0.0.683 | 22 / 9 | |
| 0.0.682 | 22 / 9 | |
| 0.0.681 | 22 / 9 | |
| 0.0.680 | 22 / 9 | |
| 0.0.679 | 22 / 9 | |
| 0.0.678 | 22 / 9 | |
| 0.0.677 | 22 / 9 | |
| 0.0.676 | 22 / 9 | |
| 0.0.675 | 22 / 9 | |
| 0.0.674 | 22 / 9 | |
| 0.0.673 | 22 / 9 | |
| 0.0.672 | 22 / 9 | |
| 0.0.671 | 22 / 9 | |
| 0.0.670 | 22 / 9 | |
| 0.0.669 | 22 / 9 | |
| 0.0.668 | 22 / 9 | |
| 0.0.667 | 22 / 9 | |
| 0.0.666 | 21 / 9 | |
| 0.0.664 | 21 / 9 | |
| 0.0.663 | 21 / 9 | |
| 0.0.662 | 21 / 9 | |
| 0.0.661 | 21 / 9 | |
| 0.0.660 | 21 / 9 | |
| 0.0.659 | 21 / 9 | |
| 0.0.658 | 21 / 9 | |
| 0.0.657 | 21 / 9 | |
| 0.0.656 | 21 / 9 | |
| 0.0.655 | 21 / 9 |
v0.0.706
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.705
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.704
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.703
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.702
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.666
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (teambit-owner) than the most recent previously approved version (davidfirst) on 2025-04-16, but teambit-owner is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.664
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.663
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.662
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.661
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.660
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.659
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.658
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.657
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.656
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.655
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.