react-big-calendar
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Long-tenured publisher (1269d), 49 approved packages, no takeover pattern. | ai | |
| provenance | publisher-changed-stale | AI (provenance): Stable for 1269d on npm; consistent with legitimate maintainer transfer. | ai | |
| dependencies | unvetted-dep:globalize | AI (dependencies): Long-standing optional localizer dep in this package; stable false positive. | ai | |
| dependencies | unvetted-dep:react-overlays | AI (dependencies): Core UI dep used for popup/overlay positioning; stable for this package. | ai | |
| phantom-deps | phantom-dep:luxon | AI (phantom-deps): luxon is an optional localizer; declared as dep for consumers who use it, not directly imported in core. | ai | |
| phantom-deps | phantom-dep:moment-timezone | AI (phantom-deps): moment-timezone is an optional localizer dependency; same pattern. | ai | |
| phantom-deps | phantom-dep:moment | AI (phantom-deps): moment is an optional localizer; same pattern as luxon. | ai | |
| phantom-deps | phantom-dep:globalize | AI (phantom-deps): globalize is an optional localizer; same pattern. | ai | |
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): lodash-es is a declared dep used in ESM build; phantom-dep heuristic false positive. | ai |
Versions (showing 51 of 75)
| Version | Deps | Published |
|---|---|---|
| 1.20.0 | 16 / 62 | |
| 1.19.6 | 16 / 59 | |
| 1.19.4 | 16 / 59 | |
| 1.19.3 | 16 / 59 | |
| 1.19.2 | 16 / 59 | |
| 1.19.1 | 16 / 59 | |
| 1.19.0 | 16 / 59 | |
| 1.18.0 | 16 / 59 | |
| 1.17.1 | 16 / 59 | |
| 1.17.0 | 16 / 59 | |
| 1.16.3 | 16 / 59 | |
| 1.16.2 | 16 / 59 | |
| 1.16.1 | 16 / 59 | |
| 1.16.0 | 16 / 59 | |
| 1.15.0 | 16 / 59 | |
| 1.14.1 | 16 / 59 | |
| 1.14.0 | 16 / 59 | |
| 1.13.4 | 16 / 59 | |
| 1.13.3 | 16 / 59 | |
| 1.13.2 | 16 / 59 | |
| 1.13.1 | 16 / 59 | |
| 1.13.0 | 16 / 59 | |
| 1.12.2 | 16 / 59 | |
| 1.12.1 | 16 / 59 | |
| 1.12.0 | 16 / 59 | |
| 1.11.7 | 16 / 59 | |
| 1.11.6 | 16 / 59 | |
| 1.11.5 | 16 / 59 | |
| 1.11.4 | 16 / 59 | |
| 1.11.3 | 16 / 59 | |
| 1.11.2 | 16 / 59 | |
| 1.11.1 | 16 / 59 | |
| 1.11.0 | 16 / 59 | |
| 1.10.3 | 16 / 59 | |
| 1.10.2 | 16 / 59 | |
| 1.10.1 | 16 / 59 | |
| 1.10.0 | 16 / 59 | |
| 1.9.2 | 16 / 59 | |
| 1.9.1 | 16 / 59 | |
| 1.9.0 | 16 / 59 | |
| 1.8.7 | 16 / 59 | |
| 1.8.6 | 16 / 59 | |
| 1.8.5 | 16 / 59 | |
| 1.8.4 | 16 / 59 | |
| 1.8.3 | 16 / 59 | |
| 1.8.2 | 16 / 57 | |
| 1.8.1 | 16 / 57 | |
| 1.8.0 | 16 / 57 | |
| 1.7.0 | 16 / 57 | |
| 1.6.9 | 16 / 57 | |
| 1.6.8 | 16 / 57 |
v1.20.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.12.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.12.0
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-04-25. It has since remained available on npm for 820 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.7
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-04-25. It has since remained available on npm for 820 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.6
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-04-15. It has since remained available on npm for 830 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.5
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-04-15. It has since remained available on npm for 830 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.4
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-04-15. It has since remained available on npm for 830 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.3
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-04-02. It has since remained available on npm for 843 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.2
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-03-12. It has since remained available on npm for 864 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.1
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-03-04. It has since remained available on npm for 872 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.0
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-26. It has since remained available on npm for 879 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.3
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-21. It has since remained available on npm for 884 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.2
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-19. It has since remained available on npm for 886 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.1
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-14. It has since remained available on npm for 891 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.10.0
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-09. It has since remained available on npm for 896 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.2
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-09. It has since remained available on npm for 896 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.1
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-07. It has since remained available on npm for 898 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.0
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-02-07. It has since remained available on npm for 898 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.7
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-01-26. It has since remained available on npm for 910 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.6
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2024-01-08. It has since remained available on npm for 928 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.5
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-10-30. It has since remained available on npm for 998 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.4
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-09-18. It has since remained available on npm for 1040 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.3
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-09-18. It has since remained available on npm for 1040 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.2
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-08-07. It has since remained available on npm for 1082 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.1
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-06-05. It has since remained available on npm for 1145 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-06-02. It has since remained available on npm for 1148 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-06-02. It has since remained available on npm for 1148 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.9
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-03-24. It has since remained available on npm for 1218 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.8
2 findingsThis version was published by a different npm account (cutterbl) than the most recent previously approved version (monastic.panic) on 2023-02-17. It has since remained available on npm for 1253 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.