@tradejs/app
Installable Next.js UI for the TradeJS open-source framework: dashboards, backtests, charts, and runtime data.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:hapi | AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'hapi' is coincidental, not a typosquat. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'pg' is coincidental, not a typosquat. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'yup' is coincidental, not a typosquat. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): Scoped package @tradejs/app; Levenshtein match to 'ajv' is coincidental, not a typosquat. | ai | |
| phantom-deps | phantom-dep:react-is | AI (phantom-deps): Next.js/React app; react-is is a peer/config dep not directly imported in source. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Next.js app; react-dom used by framework, not directly imported in app source. | ai | |
| phantom-deps | phantom-dep:@emotion/react | AI (phantom-deps): Chakra UI peer dep; referenced in config, not directly imported. | ai | |
| phantom-deps | phantom-dep:@tradejs/connectors | AI (phantom-deps): Same-org sibling package; phantom-dep heuristic unreliable for intra-monorepo deps. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 1.0.9 | 29 / 0 | |
| 1.0.8 | 29 / 0 | |
| 1.0.6 | 29 / 0 | |
| 1.0.5 | 29 / 0 | |
| 1.0.4 | 29 / 0 | |
| 1.0.3 | 29 / 0 | |
| 1.0.2 | 29 / 0 | |
| 1.0.0 | 29 / 0 |
v1.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.