react-infinite-scroller No license 28 versions

react-infinite-scroller

npm Repository Homepage

28

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

danbovey

Keywords

infinitescrollreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:new-function-constructor	AI (semgrep): Fires in docs/ demo script, not shipped library code; benign JSONP parsing pattern.	ai	2026/07/24

Versions (showing 28 of 28)

Version	Deps	Published
1.2.6	1 / 28	2022-04-13
1.2.5	1 / 33	2022-02-09
1.2.4	1 / 33	2018-12-24
1.2.3	1 / 33	2018-12-23
1.2.2	1 / 32	2018-10-10
1.2.1	1 / 32	2018-09-14
1.2.0	1 / 32	2018-06-25
1.1.4	1 / 32	2018-04-09
1.1.3	1 / 32	2018-01-15
1.1.2	1 / 32	2017-12-13
1.1.1	1 / 32	2017-11-09
1.1.0	1 / 28	2017-11-07
1.0.15	1 / 28	2017-08-09
1.0.14	1 / 28	2017-07-08
1.0.13	1 / 28	2017-06-27
1.0.12	1 / 27	2017-05-11
1.0.11	0 / 27	2017-05-09
1.0.10	0 / 28	2017-05-06
1.0.9	0 / 28	2017-04-25
1.0.8	0 / 7	2017-04-19
1.0.7	0 / 6	2017-02-17
1.0.6	0 / 6	2017-02-08
1.0.5	0 / 6	2017-02-08
1.0.4	0 / 6	2016-12-06
1.0.3	0 / 6	2016-12-05
1.0.2	0 / 7	2016-11-17
1.0.1	0 / 7	2016-09-23
1.0.0	0 / 7	2016-09-23

v1.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.8

2 findings

HIGH new-function-constructor: docs/js/script.js:2012 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/c0a669370fa5477c63fc0a40afff545e2037ef6e/docs/js/script.js#L2012 2010 | } 2011 | else { > 2012 | response = new Function('return (' + xhr.responseText + ')')(); 2013 | } 2014 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.7

2 findings

HIGH new-function-constructor: docs/js/script.js:2008 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/7625b2445d67c24c3b392824612f43d877344c2e/docs/js/script.js#L2008 2006 | } 2007 | else { > 2008 | response = new Function('return (' + xhr.responseText + ')')(); 2009 | } 2010 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.6

2 findings

HIGH new-function-constructor: docs/js/script.js:1806 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/206865c39292b547f989faf7588715217bcd1d75/docs/js/script.js#L1806 1804 | } 1805 | else { > 1806 | response = new Function('return (' + xhr.responseText + ')')(); 1807 | } 1808 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.5

2 findings

HIGH new-function-constructor: docs/js/script.js:1806 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/8165370a27b64985bea5c1480f962672ea43c280/docs/js/script.js#L1806 1804 | } 1805 | else { > 1806 | response = new Function('return (' + xhr.responseText + ')')(); 1807 | } 1808 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.4

2 findings

HIGH new-function-constructor: docs/js/script.js:1829 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/bb503ed2014910b1c2aa0e78c3d4cc9e79a1f9d6/docs/js/script.js#L1829 1827 | } 1828 | else { > 1829 | response = new Function('return (' + xhr.responseText + ')')(); 1830 | } 1831 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.3

2 findings

HIGH new-function-constructor: docs/js/script.js:1829 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/5f5014aaf8b3f68f9271437b8d9b19a3ffcbbd51/docs/js/script.js#L1829 1827 | } 1828 | else { > 1829 | response = new Function('return (' + xhr.responseText + ')')(); 1830 | } 1831 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.2

2 findings

HIGH new-function-constructor: docs/js/script.js:1829 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/a87fc7c7e998e2c7709e012dfe747fee27f267a7/docs/js/script.js#L1829 1827 | } 1828 | else { > 1829 | response = new Function('return (' + xhr.responseText + ')')(); 1830 | } 1831 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.1

2 findings

HIGH new-function-constructor: docs/js/script.js:1829 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/ea111dd172813de01998f0d4e4a08cf34891a59e/docs/js/script.js#L1829 1827 | } 1828 | else { > 1829 | response = new Function('return (' + xhr.responseText + ')')(); 1830 | } 1831 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

2 findings

HIGH new-function-constructor: docs/js/script.js:1829 semgrep

new Function() dynamically compiles and executes code, similar to eval(). Common in template engines and parsers — verify the input source. Source: https://github.com/CassetteRocks/react-infinite-scroller/blob/ecb9c24e81352cb2bc23529758b2eae51fd337d5/docs/js/script.js#L1829 1827 | } 1828 | else { > 1829 | response = new Function('return (' + xhr.responseText + ')')(); 1830 | } 1831 | }

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.