@times-components/ts-components

Reuseable Typescript React Components

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

marcincubernewsuknews-tools

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/components/opta/football/player-stats/__tests__/OptaFootballPlayerRanking.test.js	AI (source-diff): Readable transpiled test file in dist/; long lines are bundler output, not obfuscation. Stable for this package.	ai	2026/05/26
source-diff	obfuscated-file:dist/components/opta/football/starting-formations/__tests__/OptaFootballStartingFormations.test.js	AI (source-diff): Readable transpiled test file in dist/; long lines are bundler output, not obfuscation. Stable for this package.	ai	2026/05/26
source-diff	obfuscated-file:dist/components/opta/football/starting-formations/OptaFootballStartingFormations.js	AI (source-diff): Readable transpiled React component in dist/; long lines are bundler output, not obfuscation. Stable for this package.	ai	2026/05/26
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/timeline/WidgetContainer.js	AI (source-diff): Readable styled-components source; long lines from template literals.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/momentum/tooltip.js	AI (source-diff): Readable styled-components React source; long lines from template literals.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/momentum/__tests__/tooltip.test.js	AI (source-diff): Readable test file; long lines from compiled test harness.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/__tests__/useAdaptiveMatchFeed.test.js	AI (source-diff): Readable test file; long lines from compiled test harness.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/momentum/useEventTooltip.js	AI (source-diff): Readable React hook source; long lines from template literals.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/momentum/__tests__/useEventTooltip.test.js	AI (source-diff): Readable test file; long lines from compiled test harness.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/timeline/OptaMatchStatsTimeline.js	AI (source-diff): Readable TypeScript/React dist output; long lines from template literals, not obfuscation.	ai	2026/05/20
source-diff	obfuscated-file:dist/components/opta/football/opta-match-stats/timeline/__tests__/OptaMatchStatsTimeline.test.js	AI (source-diff): Readable test file; long lines from compiled test harness, not obfuscation.	ai	2026/05/20
phantom-deps	phantom-dep:@times-components/related-articles	AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic is a stable false positive here.	ai	2026/05/17
phantom-deps	phantom-dep:@times-components/button	AI (phantom-deps): Same-org monorepo sibling; phantom-dep heuristic is a stable false positive here.	ai	2026/05/17
phantom-deps	phantom-dep:regenerator-runtime	AI (phantom-deps): Known implicit runtime dep for transpiled async code; stable false positive for this package.	ai	2026/05/17
phantom-deps	phantom-dep:react-apollo	AI (phantom-deps): Used via provider/query deps; config-only reference is expected for this monorepo package.	ai	2026/05/17
phantom-deps	phantom-dep:react-dom	AI (phantom-deps): Listed as both dep and devDep in a React component library; config-only reference is expected.	ai	2026/05/17

Versions (showing 31 of 31)

Version	Deps	Published
1.181.1	27 / 28	2026-05-20
1.180.0	27 / 28	2026-05-18
1.176.0	27 / 28	2026-04-29
1.174.0	27 / 28	2026-04-27
1.172.1	27 / 28	2026-04-22
1.171.0	27 / 28	2026-04-16
1.150.0	27 / 28	2026-02-02
1.149.0	27 / 28	2026-01-29
1.148.1	27 / 28	2026-01-23
1.148.0	27 / 28	2026-01-22
1.147.1	27 / 28	2026-01-19
1.147.0	27 / 28	2026-01-19
1.146.1	27 / 28	2026-01-08
1.145.0	27 / 27	2025-12-09
1.144.0	26 / 27	2025-12-02
1.143.1	26 / 27	2025-11-20
1.143.0	26 / 27	2025-11-19
1.141.0	26 / 27	2025-11-04
1.140.5	25 / 27	2025-11-03
1.140.2	25 / 27	2025-09-19
1.140.0	25 / 27	2025-09-15
1.139.0	25 / 27	2025-09-10
1.138.2	25 / 27	2025-09-09
1.135.0	25 / 27	2025-06-25
1.134.0	25 / 27	2025-06-23
1.133.1	25 / 27	2025-06-19
1.132.0	25 / 27	2025-06-17
1.131.2	25 / 27	2025-06-10
1.131.0	25 / 27	2025-06-03
1.129.4	25 / 27	2025-05-02
1.129.3	25 / 27	2025-05-01

v1.181.1

4 findings

HIGH New obfuscated file: dist/components/opta/football/player-stats/__tests__/OptaFootballPlayerRanking.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/starting-formations/OptaFootballStartingFormations.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/starting-formations/__tests__/OptaFootballStartingFormations.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.180.0

9 findings

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/timeline/OptaMatchStatsTimeline.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/timeline/__tests__/OptaMatchStatsTimeline.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/momentum/tooltip.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/momentum/__tests__/tooltip.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/__tests__/useAdaptiveMatchFeed.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/momentum/useEventTooltip.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/momentum/__tests__/useEventTooltip.test.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/components/opta/football/opta-match-stats/timeline/WidgetContainer.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.176.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.174.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.172.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.171.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.150.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.149.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.148.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.148.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.147.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.147.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.146.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.145.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.144.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.143.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.143.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.141.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.140.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.140.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.140.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.139.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.138.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.135.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.134.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.133.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.132.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.131.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.131.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.129.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.129.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.