@warp-ds/elements
Custom elements for Warp
4
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
imprashastpearofducksdigitalsadhutrygve-lie
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@lit-labs/rollup-plugin-minify-html-literals | AI (phantom-deps): Build plugin referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@warp-ds/elements-core | AI (phantom-deps): Same-org dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-commonjs | AI (phantom-deps): Framework-scoped rollup plugin loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-node-resolve | AI (phantom-deps): Framework-scoped rollup plugin loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Common implicit runtime dep for TypeScript output; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:rollup | AI (phantom-deps): Build tool referenced in config files; not a runtime import concern. | ai | |
| phantom-deps | phantom-dep:date-fns | AI (phantom-deps): Referenced in config/build files; expected pattern for this component library. | ai | |
| phantom-deps | phantom-dep:@warp-ds/css | AI (phantom-deps): Same-org dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:scroll-doctor | AI (phantom-deps): Referenced in config files; expected build pattern. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-terser | AI (phantom-deps): Framework-scoped rollup plugin loaded by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@rollup/plugin-replace | AI (phantom-deps): Framework-scoped rollup plugin loaded by convention; stable false positive. | ai | |
| provenance | publisher-changed | AI (provenance): Package migrated to GitHub Actions CI publishing with SLSA provenance; this is the expected new publisher going forward. | ai | |
| provenance | slsa-provenance | AI (provenance): Package consistently publishes with SLSA provenance attestation via CI. | ai | |
| provenance | no-provenance | AI (provenance): Established warp-ds org package; lack of provenance is common and not a risk signal here. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 2.9.0 | 3 / 69 | |
| 2.8.1 | 3 / 71 | |
| 2.2.1 | 16 / 58 | |
| 2.2.0 | 16 / 58 |
v2.9.0
2 findings
HIGH
Publisher changed: imprashast → GitHub Actions (on 2026-04-30)
provenance
This version was published by a different npm account than previous versions on 2026-04-30. This could indicate a legitimate maintainer transition or an account compromise.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.2.1
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.2.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.