@thesvg/react
Typed React SVG components for all 3,800+ brand icons from thesvg.org
26
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
gdsks
Keywords
svgiconsbrandlogosreactcomponentstree-shakeableesmtypescript
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/lume.js | AI (source-diff): Auto-generated SVG icon component; long lines are inline JSON path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/baoviet-holdings.js | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/bamboo-airways.js | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/adnoc.js | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/usnews.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/tpbank.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/tata-consultancy-services.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/sabeco.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/pnj.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/novaland.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/microsoft-planner.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/microsoft-loop.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/microsoft-365-copilot.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/lume.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/baoviet-holdings.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/bamboo-airways.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/adnoc.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are minified path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/google-keep-2026.cjs | AI (source-diff): Same pattern: auto-generated SVG icon component with inline JSON path data. | ai | |
| source-diff | obfuscated-file:dist/google-slides-2026.js | AI (source-diff): ESM variant of the same auto-generated SVG icon component. | ai | |
| source-diff | obfuscated-file:dist/google-keep-2026.js | AI (source-diff): ESM variant of the same auto-generated SVG icon component. | ai | |
| source-diff | obfuscated-file:dist/google-calendar-2026.js | AI (source-diff): ESM variant of the same auto-generated SVG icon component. | ai | |
| source-diff | obfuscated-file:dist/google-slides-2026.cjs | AI (source-diff): Same pattern: auto-generated SVG icon component with inline JSON path data. | ai | |
| source-diff | obfuscated-file:dist/google-calendar-2026.cjs | AI (source-diff): Long lines are JSON-serialized SVG path data in auto-generated icon components, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/pinecone.cjs | AI (source-diff): Long lines are minified SVG path data in React components, not obfuscation; expected for an SVG icon library. | ai | |
| source-diff | obfuscated-file:dist/vinfast.cjs | AI (source-diff): Long lines are inline SVG path data in auto-generated brand icon components, not obfuscation. Pattern is stable across all icon files in this package. | ai | |
| source-diff | obfuscated-file:dist/coupang.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are inlined JSON path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/autodesk-inventor.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are inlined JSON path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/cplusplus-builder.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/corejs.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/character-animator.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/ceylon.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/capture.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/browserstack.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/bridge.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/audition.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/awk.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/denojs.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/dataspell.cjs | AI (source-diff): Auto-generated SVG icon component; long lines are SVG path data, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/adobe-aero.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 579 new files are per-icon CJS modules expected for a 3800+ icon library expansion. | ai | |
| source-diff | obfuscated-file:dist/argocd.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | obfuscated-file:dist/apl.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | obfuscated-file:dist/anker.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | obfuscated-file:dist/amplitude.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | obfuscated-file:dist/al-jazeera.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | obfuscated-file:dist/adobe-stock.cjs | AI (source-diff): Same pattern: inline SVG path data in auto-generated React component. | ai | |
| source-diff | obfuscated-file:dist/aarch64.cjs | AI (source-diff): Long lines are inline SVG path JSON data in auto-generated icon components, not obfuscation. | ai |
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 3.0.10 | 0 / 3 | |
| 3.0.9 | 0 / 3 | |
| 3.0.8 | 0 / 3 | |
| 3.0.7 | 0 / 3 | |
| 3.0.6 | 0 / 3 | |
| 3.0.5 | 0 / 3 | |
| 3.0.4 | 0 / 3 | |
| 3.0.3 | 0 / 3 | |
| 3.0.2 | 0 / 3 | |
| 3.0.1 | 0 / 3 | |
| 3.0.0 | 0 / 3 | |
| 2.1.12 | 0 / 3 | |
| 2.1.11 | 0 / 3 | |
| 2.1.10 | 0 / 3 | |
| 2.1.9 | 0 / 3 | |
| 2.1.8 | 0 / 3 | |
| 2.1.7 | 0 / 3 | |
| 2.1.6 | 0 / 3 | |
| 2.1.5 | 0 / 3 | |
| 2.1.4 | 0 / 3 | |
| 2.1.3 | 0 / 3 | |
| 2.1.2 | 0 / 3 | |
| 0.5.0 | 0 / 3 | |
| 0.4.1 | 0 / 3 | |
| 0.4.0 | 0 / 3 | |
| 0.1.0 | 0 / 3 |
v0.5.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.1
2 findings
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
INFO
Publisher changed: gdsks → GitHub Actions (on 2026-03-09, now via trusted publisher with provenance)
provenance
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (gdsks) on 2026-03-09, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.4.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.