@vitessce/vit-s
8
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
keller-mark
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Scoped monorepo sub-package; missing description is a known pattern, not a malware signal. | ai | |
| dependencies | unvetted-dep:@placemarkio/flat-drop-files | AI (dependencies): Legitimate file-drop utility from Placemark org; no malware indicators. | ai | |
| dependencies | unvetted-dep:react-grid-layout-with-lodash | AI (dependencies): Known fork of react-grid-layout with lodash-es; stable dependency for this package. | ai | |
| phantom-deps | phantom-dep:@vitessce/sets-utils | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo packages. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Common utility dep; may be used indirectly via re-exports in monorepo build. | ai | |
| typosquat | typosquat.levenshtein:vite | AI (typosquat): Scoped @vitessce org package; not a typosquat of vite. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:fast-deep-equal | AI (phantom-deps): Common utility; may be used via bundled output. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:jss-plugin-global | AI (phantom-deps): CSS-in-JS dep; may be referenced via config/build. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:zarrita | AI (phantom-deps): Zarr storage dep used in build/config context; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:vitest | AI (typosquat): Scoped @vitessce org package; not a typosquat of vitest. Stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vitessce/plugins | AI (phantom-deps): Same-org sibling dep; phantom-dep heuristic unreliable for monorepo packages. | ai |