jotai — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

daishidrcmda

Keywords

reactstatemanagermanagementrecoilstore

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:system/experimental.production.js	AI (source-diff): Minified SystemJS production build output; stable across releases.	ai	2026/07/21
source-diff	obfuscated-file:umd/experimental.production.js	AI (source-diff): Minified UMD production build output; stable across releases.	ai	2026/07/21
provenance	missing-githead	AI (provenance): Published via GitHub Actions with SLSA attestation; gitHead absence is a metadata artifact, not a risk signal.	ai	2026/06/12
provenance	publisher-changed	AI (provenance): Jotai migrated to GitHub Actions CI/CD publishing with SLSA provenance attestation. Publisher change from daishi to GitHub Actions is a legitimate, documented transition for this well-known package.	ai	2026/04/27
source-diff	obfuscated-file:umd/vanilla/internals.production.js	AI (source-diff): This is a standard minified production build artifact (UMD format) of jotai internals. Long lines are from minification, not obfuscation. Content is clearly legitimate jotai state management code.	ai	2026/04/27
source-diff	obfuscated-file:system/vanilla/internals.production.js	AI (source-diff): This is a standard minified production build artifact (SystemJS format) of jotai internals. Long lines are from minification, not obfuscation. Content is clearly legitimate jotai state management code.	ai	2026/04/27
typosquat	typosquat.levenshtein:joi	AI (typosquat): Jotai is a well-established React state management library, not a typosquat of joi (a validation library). The name similarity is coincidental; jotai predates and is unrelated to joi.	ai	2026/04/25

Versions (showing 51 of 70)

View all versions

Version	Deps	Published
2.20.2	0 / 0	2026-07-14
2.20.1	0 / 0	2026-06-11
2.20.0	0 / 0	2026-05-06
2.19.1	0 / 0	2026-04-07
2.19.0	0 / 0	2026-03-24
2.18.1	0 / 0	2026-03-09
2.18.0	0 / 0	2026-02-19
2.17.1	0 / 0	2026-02-04
2.17.0	0 / 0	2026-01-28
2.16.2	0 / 0	2026-01-13
2.16.1	0 / 0	2025-12-26
2.16.0	0 / 0	2025-12-09
2.15.2	0 / 0	2025-12-01
2.15.1	0 / 0	2025-11-01
2.15.0	0 / 0	2025-09-25
2.14.0	0 / 0	2025-09-08
2.13.1	0 / 0	2025-08-11
2.13.0	0 / 0	2025-08-04
2.12.5	0 / 0	2025-05-27
2.12.4	0 / 0	2025-05-06
2.12.3	0 / 0	2025-04-14
2.12.2	0 / 0	2025-03-10
2.12.1	0 / 0	2025-02-17
2.12.0	0 / 0	2025-02-11
2.11.3	0 / 0	2025-02-01
2.11.2	0 / 0	2025-01-31
2.11.1	0 / 0	2025-01-20
2.11.0	0 / 0	2024-12-23
2.10.4	0 / 0	2024-12-16
2.10.3	0 / 0	2024-11-20
2.10.2	0 / 0	2024-11-11
2.10.1	0 / 0	2024-10-15
2.10.0	0 / 0	2024-09-20
2.9.3	0 / 0	2024-08-13
2.9.2	0 / 0	2024-08-07
2.9.1	0 / 0	2024-07-23
2.9.0	0 / 0	2024-07-09
2.8.4	0 / 0	2024-06-28
2.8.3	0 / 0	2024-06-03
2.8.2	0 / 0	2024-05-27
2.8.1	0 / 0	2024-05-22
2.8.0	0 / 0	2024-04-08
2.7.2	0 / 0	2024-03-29
2.7.1	0 / 0	2024-03-15
2.7.0	0 / 0	2024-02-28
2.6.5	0 / 0	2024-02-21
2.6.4	0 / 0	2024-01-31
2.6.3	0 / 0	2024-01-24
2.6.2	0 / 0	2024-01-16
2.6.1	0 / 0	2023-12-28
2.6.0	0 / 0	2023-11-25

v2.20.2

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

v2.12.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.8.0

3 findings

HIGH New obfuscated file: system/experimental.production.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: umd/experimental.production.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.