← Home

@transferwise/components

npm Repository

Neptune React components

51
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

tw-circlecinpn_ci_wiseitservicestw-circle-public

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:etc-passwd-access AI (semgrep): Test asserting sanitiser blocks file:// paths, not real /etc/passwd access. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Test asserting sanitiser blocks raw-IP URLs, not an actual raw-IP request. ai
phantom-deps phantom-dep:@popperjs/core AI (phantom-deps): Used via config/react-popper indirection, common pattern. ai
maintainer-change maintainer-added AI (maintainer-change): Same CI migration as publisher-changed; not a compromise indicator. ai
provenance publisher-changed AI (provenance): CI account transition with strong track record (62 approved, 0 rejected) and unchanged provenance. ai
publish-pattern new-deps-added AI (publish-pattern): clsx and virtua are established, widely-used packages. ai
provenance no-provenance AI (provenance): Long-established org package; no provenance is a process gap, not a security signal for this publisher. ai
phantom-deps phantom-dep:@babel/runtime AI (phantom-deps): Framework-scoped babel runtime; loaded by convention via babel plugin, not direct import. ai
phantom-deps phantom-dep:@transferwise/neptune-tokens AI (phantom-deps): Same-org design token package; likely consumed via CSS/Less rather than direct JS import. ai
phantom-deps phantom-dep:core-js AI (phantom-deps): core-js is a known polyfill runtime dep; not directly imported but legitimately used via babel transform. ai

Versions (showing 51 of 84)

View all versions
Version Deps Published
46.159.0 17 / 55
46.158.0 17 / 55
46.157.1 17 / 55
46.157.0 17 / 55
46.156.0 17 / 55
46.155.1 17 / 55
46.155.0 17 / 55
46.154.0 17 / 55
46.153.0 17 / 55
46.152.0 17 / 55
46.151.1 17 / 55
46.151.0 17 / 55
46.150.0 17 / 55
46.149.2 17 / 55
46.149.1 17 / 55
46.149.0 17 / 55
46.148.1 17 / 55
46.148.0 17 / 55
46.147.0 17 / 55
46.146.0 17 / 55
46.145.0 17 / 55
46.144.1 17 / 55
46.144.0 17 / 56
46.143.1 17 / 56
46.143.0 17 / 56
46.142.0 17 / 56
46.141.0 17 / 56
46.140.1 17 / 56
46.140.0 17 / 56
46.139.0 17 / 56
46.138.0 17 / 56
46.137.1 17 / 56
46.137.0 17 / 52
46.136.1 17 / 52
46.136.0 17 / 52
46.135.3 17 / 52
46.135.2 17 / 52
46.135.1 19 / 52
46.135.0 19 / 52
46.134.0 19 / 52
46.133.1 19 / 52
46.133.0 19 / 52
46.132.1 19 / 52
46.132.0 19 / 52
46.131.2 19 / 52
46.131.1 19 / 52
46.131.0 19 / 52
46.130.3 18 / 52
46.130.2 18 / 52
46.130.1 18 / 52
46.130.0 18 / 52

v46.159.0

3 findings
HIGH shady-links-raw-ip: src/Markup/utils/sanitise.test.ts:262 semgrep

HTTP request to raw IP address — legitimate packages use domain names 260 | 261 | it('blocks AWS metadata endpoint', () => { > 262 | expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined(); 263 | }); 264 |

HIGH etc-passwd-access: src/Markup/utils/sanitise.test.ts:338 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 336 | describe('additional blocked protocols (regression)', () => { 337 | it('blocks file: protocol', () => { > 338 | expect(sanitiseHref('file:///etc/passwd')).toBeUndefined(); 339 | }); 340 |

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.158.0

3 findings
HIGH shady-links-raw-ip: src/Markup/utils/sanitise.test.ts:262 semgrep

HTTP request to raw IP address — legitimate packages use domain names 260 | 261 | it('blocks AWS metadata endpoint', () => { > 262 | expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined(); 263 | }); 264 |

HIGH etc-passwd-access: src/Markup/utils/sanitise.test.ts:338 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 336 | describe('additional blocked protocols (regression)', () => { 337 | it('blocks file: protocol', () => { > 338 | expect(sanitiseHref('file:///etc/passwd')).toBeUndefined(); 339 | }); 340 |

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.157.1

3 findings
HIGH shady-links-raw-ip: src/Markup/utils/sanitise.test.ts:262 semgrep

HTTP request to raw IP address — legitimate packages use domain names 260 | 261 | it('blocks AWS metadata endpoint', () => { > 262 | expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined(); 263 | }); 264 |

HIGH etc-passwd-access: src/Markup/utils/sanitise.test.ts:338 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 336 | describe('additional blocked protocols (regression)', () => { 337 | it('blocks file: protocol', () => { > 338 | expect(sanitiseHref('file:///etc/passwd')).toBeUndefined(); 339 | }); 340 |

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.157.0

3 findings
HIGH shady-links-raw-ip: src/Markup/utils/sanitise.test.ts:262 semgrep

HTTP request to raw IP address — legitimate packages use domain names 260 | 261 | it('blocks AWS metadata endpoint', () => { > 262 | expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined(); 263 | }); 264 |

HIGH etc-passwd-access: src/Markup/utils/sanitise.test.ts:338 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 336 | describe('additional blocked protocols (regression)', () => { 337 | it('blocks file: protocol', () => { > 338 | expect(sanitiseHref('file:///etc/passwd')).toBeUndefined(); 339 | }); 340 |

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.156.0

3 findings
HIGH shady-links-raw-ip: src/Markup/utils/sanitise.test.ts:262 semgrep

HTTP request to raw IP address — legitimate packages use domain names 260 | 261 | it('blocks AWS metadata endpoint', () => { > 262 | expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined(); 263 | }); 264 |

HIGH etc-passwd-access: src/Markup/utils/sanitise.test.ts:338 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 336 | describe('additional blocked protocols (regression)', () => { 337 | it('blocks file: protocol', () => { > 338 | expect(sanitiseHref('file:///etc/passwd')).toBeUndefined(); 339 | }); 340 |

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.155.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.155.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.154.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.153.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.152.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.151.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.133.1

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-27) provenance

This version was published by a different npm account than previous versions on 2026-03-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.133.0

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-25) provenance

This version was published by a different npm account than previous versions on 2026-03-25. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.132.1

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-17) provenance

This version was published by a different npm account than previous versions on 2026-03-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.132.0

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-13) provenance

This version was published by a different npm account than previous versions on 2026-03-13. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.131.2

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-11) provenance

This version was published by a different npm account than previous versions on 2026-03-11. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.131.1

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-09) provenance

This version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.131.0

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-06) provenance

This version was published by a different npm account than previous versions on 2026-03-06. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.130.3

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-05) provenance

This version was published by a different npm account than previous versions on 2026-03-05. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.130.2

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-04) provenance

This version was published by a different npm account than previous versions on 2026-03-04. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.130.1

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-04) provenance

This version was published by a different npm account than previous versions on 2026-03-04. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v46.130.0

2 findings
HIGH Publisher changed: tw-circleci → npn_ci_wise (on 2026-03-03) provenance

This version was published by a different npm account than previous versions on 2026-03-03. This could indicate a legitimate maintainer transition or an account compromise.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.