← Home

react-big-calendar

npm Repository Homepage
5
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

monastic.panictobiasandersencutterbl

Keywords

schedulerreact-componentreactcalendareventsfull calendar

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:globalize AI (dependencies): Long-standing optional localizer dep in this package; stable false positive. ai
dependencies unvetted-dep:react-overlays AI (dependencies): Core UI dep used for popup/overlay positioning; stable for this package. ai
phantom-deps phantom-dep:globalize AI (phantom-deps): globalize is an optional localizer; same pattern. ai
phantom-deps phantom-dep:luxon AI (phantom-deps): luxon is an optional localizer; declared as dep for consumers who use it, not directly imported in core. ai
phantom-deps phantom-dep:moment-timezone AI (phantom-deps): moment-timezone is an optional localizer dependency; same pattern. ai
phantom-deps phantom-dep:lodash-es AI (phantom-deps): lodash-es is a declared dep used in ESM build; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:moment AI (phantom-deps): moment is an optional localizer; same pattern as luxon. ai

Versions (showing 5 of 5)

Version Deps Published
1.19.4 16 / 59
1.19.3 16 / 59
1.19.2 16 / 59
1.19.1 16 / 59
1.19.0 16 / 59

v1.19.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.19.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.19.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.