@trackunit/css-tailwind
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed-stale | AI (provenance): 451 days stale with no removal; consistent with legitimate publisher, not takeover. | ai | |
| phantom-deps | phantom-dep:@tailwindcss/typography | AI (phantom-deps): Used as Tailwind plugin in config, not directly imported. | ai | |
| phantom-deps | phantom-dep:@trackunit/css-component-tokens | AI (phantom-deps): Same-org design token dep referenced via config, not code import. | ai | |
| phantom-deps | phantom-dep:@trackunit/css-tailwind-custom-properties-plugin | AI (phantom-deps): Same-org Tailwind plugin dep used via config, not direct import. | ai |
Versions (showing 100 of 264)
| Version | Deps | Published |
|---|---|---|
| 1.7.47 | 6 / 0 | |
| 1.7.45 | 6 / 0 | |
| 1.7.44 | 6 / 0 | |
| 1.7.43 | 6 / 0 | |
| 1.7.41 | 6 / 0 | |
| 1.7.40 | 6 / 0 | |
| 1.7.39 | 6 / 0 | |
| 1.7.38 | 6 / 0 | |
| 1.7.36 | 6 / 0 | |
| 1.7.35 | 6 / 0 | |
| 1.7.33 | 6 / 0 | |
| 1.7.32 | 6 / 0 | |
| 1.7.31 | 6 / 0 | |
| 1.7.28 | 6 / 0 | |
| 1.7.27 | 6 / 0 | |
| 1.7.25 | 6 / 0 | |
| 1.7.24 | 6 / 0 | |
| 1.7.23 | 6 / 0 | |
| 1.7.22 | 6 / 0 | |
| 1.7.20 | 6 / 0 | |
| 1.7.19 | 6 / 0 | |
| 1.7.18 | 6 / 0 | |
| 1.7.17 | 6 / 0 | |
| 1.7.15 | 6 / 0 | |
| 1.7.14 | 6 / 0 | |
| 1.7.12 | 6 / 0 | |
| 1.7.11 | 6 / 0 | |
| 1.7.10 | 6 / 0 | |
| 1.7.8 | 6 / 0 | |
| 1.7.7 | 6 / 0 | |
| 1.7.6 | 6 / 0 | |
| 1.7.5 | 6 / 0 | |
| 1.7.4 | 6 / 0 | |
| 1.6.69 | 6 / 0 | |
| 1.6.66 | 6 / 0 | |
| 1.6.65 | 6 / 0 | |
| 1.6.60 | 6 / 0 | |
| 1.6.58 | 6 / 0 | |
| 1.6.54 | 6 / 0 | |
| 1.6.53 | 6 / 0 | |
| 1.6.52 | 6 / 0 | |
| 1.6.51 | 6 / 0 | |
| 1.6.47 | 6 / 0 | |
| 1.6.46 | 6 / 0 | |
| 1.6.45 | 6 / 0 | |
| 1.6.44 | 6 / 0 | |
| 1.6.43 | 6 / 0 | |
| 1.6.40 | 6 / 0 | |
| 1.6.36 | 6 / 0 | |
| 1.6.29 | 6 / 0 | |
| 1.6.26 | 6 / 0 | |
| 1.6.22 | 6 / 0 | |
| 1.6.21 | 6 / 0 | |
| 1.6.20 | 6 / 0 | |
| 1.6.19 | 6 / 0 | |
| 1.6.17 | 6 / 0 | |
| 1.6.16 | 6 / 0 | |
| 1.6.15 | 6 / 0 | |
| 1.6.14 | 6 / 0 | |
| 1.6.13 | 6 / 0 | |
| 1.6.11 | 6 / 0 | |
| 1.6.7 | 6 / 0 | |
| 1.6.6 | 6 / 0 | |
| 1.6.5 | 6 / 0 | |
| 1.6.3 | 6 / 0 | |
| 1.5.8 | 6 / 0 | |
| 1.5.6 | 6 / 0 | |
| 1.5.5 | 6 / 0 | |
| 1.5.0 | 6 / 0 | |
| 1.4.43 | 6 / 0 | |
| 1.4.42 | 6 / 0 | |
| 1.4.41 | 6 / 0 | |
| 1.4.40 | 6 / 0 | |
| 1.4.39 | 6 / 0 | |
| 1.4.37 | 6 / 0 | |
| 1.4.36 | 6 / 0 | |
| 1.4.33 | 6 / 0 | |
| 1.4.31 | 6 / 0 | |
| 1.4.30 | 6 / 0 | |
| 1.4.28 | 6 / 0 | |
| 1.4.27 | 6 / 0 | |
| 1.4.26 | 6 / 0 | |
| 1.4.25 | 6 / 0 | |
| 1.4.23 | 6 / 0 | |
| 1.4.22 | 6 / 0 | |
| 1.4.21 | 6 / 0 | |
| 1.4.20 | 6 / 0 | |
| 1.4.19 | 6 / 0 | |
| 1.4.18 | 6 / 0 | |
| 1.4.17 | 6 / 0 | |
| 1.4.16 | 6 / 0 | |
| 1.4.14 | 6 / 0 | |
| 1.4.11 | 6 / 0 | |
| 1.3.92 | 6 / 0 | |
| 1.3.87 | 6 / 0 | |
| 1.3.78 | 6 / 0 | |
| 1.3.74 | 6 / 0 | |
| 1.3.68 | 6 / 0 | |
| 1.3.62 | 6 / 0 | |
| 1.3.60 | 6 / 0 |
v1.7.47
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.45
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.44
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.43
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.41
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.40
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.39
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.38
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.36
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.35
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.69
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.66
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.65
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.60
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.58
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.54
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.53
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.52
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.51
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.47
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.46
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.45
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.44
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.43
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.40
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.36
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.43
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.42
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.41
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.40
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.39
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.37
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.36
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.92
2 findingsThis version was published by a different npm account (tu-publisher) than the most recent previously approved version (mtandrup) on 2025-05-05. It has since remained available on npm for 439 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.87
2 findingsThis version was published by a different npm account (tu-publisher) than the most recent previously approved version (mtandrup) on 2025-05-01. It has since remained available on npm for 443 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.78
2 findingsThis version was published by a different npm account (tu-publisher) than the most recent previously approved version (mtandrup) on 2025-04-24. It has since remained available on npm for 451 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.74
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (sandbanke) than the most recent previously approved version (mtandrup) on 2025-04-16, but sandbanke is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.3.68
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.62
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.60
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.