@wordpress/icons
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Fires in build tooling (lib/generate-library.js), not published runtime code; env spread is used to unset GIT_WORK_TREE. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Fires in build tooling (lib/build-worker-utils.js); child_process is used for build steps, not runtime package behavior. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @wordpress/icons is an official WordPress package; Levenshtein match to 'cors' is a false positive. | ai | |
| phantom-deps | phantom-dep:change-case | AI (phantom-deps): change-case is declared in dependencies; phantom-dep heuristic misfires on build-time usage patterns in this monorepo package. | ai |
Versions (showing 20 of 20)
| Version | Deps | Published |
|---|---|---|
| 15.2.0 | 3 / 1 | |
| 15.1.0 | 3 / 0 | |
| 15.0.0 | 3 / 0 | |
| 14.0.1 | 4 / 0 | |
| 14.0.0 | 4 / 0 | |
| 13.3.0 | 3 / 0 | |
| 13.2.0 | 3 / 0 | |
| 13.1.0 | 3 / 0 | |
| 13.0.0 | 3 / 0 | |
| 12.2.0 | 3 / 0 | |
| 12.1.0 | 3 / 0 | |
| 12.0.0 | 3 / 0 | |
| 11.8.0 | 3 / 0 | |
| 11.7.1 | 3 / 0 | |
| 11.7.0 | 3 / 0 | |
| 11.6.0 | 2 / 0 | |
| 11.5.0 | 2 / 0 | |
| 11.4.0 | 2 / 0 | |
| 11.3.0 | 2 / 0 | |
| 11.2.0 | 2 / 0 |
v15.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (desrosj) than the most recent previously approved version (gutenbergplugin) on 2026-07-14, but desrosj is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v15.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.7.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (desrosj) than the most recent previously approved version (gutenbergplugin) on 2026-06-30, but desrosj is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.