@universityofmaryland/web-styles-library
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/cdn.js | AI (source-diff): Minified CDN bundle with readable design tokens; expected build artifact for a styles library. | ai | |
| source-diff | obfuscated-file:dist/typography/font-face/crimson-pro.js | AI (source-diff): Same base64 font embedding pattern; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/typography/font-face/barlow-condensed.js | AI (source-diff): Long lines are base64-encoded TTF font data URIs, not obfuscated code. Stable pattern for this font-embedding library. | ai | |
| provenance | missing-githead | AI (provenance): Established institutional package; occasional local publishes without gitHead are not a security risk given publisher track record. | ai | |
| source-diff | net-exec-file:dist/umd-styles.js | AI (source-diff): False positive; eval() is webpack module wrapping, not a dropper/loader. No actual network calls to external hosts. | ai | |
| source-diff | obfuscated-file:dist/umd-styles.js | AI (source-diff): Standard webpack UMD bundle with eval-wrapped modules; sourceURL comments confirm legitimate webpack build output. | ai | |
| phantom-deps | phantom-dep:postcss-js | AI (phantom-deps): PostCSS plugin used in build config files; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:postcss-discard-duplicates | AI (phantom-deps): PostCSS plugin used in build config files; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:@types/postcss-js | AI (phantom-deps): TypeScript types package; loaded by convention, not direct import. | ai | |
| phantom-deps | phantom-dep:postcss-nesting | AI (phantom-deps): PostCSS plugin used in build config files; not directly imported at runtime. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 1.8.13 | 6 / 5 | |
| 1.8.12 | 6 / 5 | |
| 1.8.11 | 6 / 5 | |
| 1.8.10 | 6 / 5 | |
| 1.8.9 | 6 / 5 | |
| 1.8.8 | 6 / 5 | |
| 1.5.1 | 4 / 0 | |
| 1.5.0 | 4 / 0 | |
| 1.4.13 | 4 / 0 | |
| 1.4.12 | 4 / 0 | |
| 1.4.11 | 4 / 0 | |
| 1.4.10 | 4 / 0 | |
| 1.4.9 | 4 / 0 | |
| 1.4.8 | 4 / 0 | |
| 1.4.7 | 4 / 0 | |
| 1.4.6 | 4 / 0 | |
| 1.4.5 | 4 / 0 | |
| 1.4.4 | 4 / 0 | |
| 1.4.3 | 4 / 0 | |
| 1.4.2 | 4 / 0 | |
| 1.4.1 | 4 / 0 | |
| 1.4.0 | 4 / 0 | |
| 1.3.5 | 0 / 4 | |
| 1.3.4 | 4 / 0 | |
| 1.3.3 | 3 / 0 | |
| 1.3.2 | 2 / 0 | |
| 1.3.1 | 0 / 0 |
v1.8.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.12
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: magnessjo.
v1.8.11
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: magnessjo.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.10
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: magnessjo.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.8
5 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: magnessjo.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.3.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.