← Home

react-json-tree

npm Repository Homepage

React JSON Viewer Component, Extracted from redux-devtools

51
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chibicodegaearontimdorralexkuzzalmoxisusmethuselah96

Keywords

reactjson viewer

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff large-new-source-files AI (source-diff): Build modernization added CJS/ESM/types/UMD outputs; 44 new files are expected compiled artifacts. ai
source-diff net-exec-file:lib/umd/react-json-tree.js AI (source-diff): Standard Rollup UMD bundle wrapper with module detection (exports/define/globalThis). Not actual network or exec calls. ai
source-diff net-exec-file:lib/umd/react-json-tree.min.js AI (source-diff): Minified version of the UMD bundle; same standard module wrapper patterns. Not malicious. ai
source-diff net-exec-file:dist/react-json-tree.umd.min.js AI (source-diff): Minified version of the same UMD bundle; standard module detection pattern triggers false positive. ai
source-diff net-exec-file:dist/react-json-tree.umd.js AI (source-diff): Standard Rollup-generated UMD bundle with module detection boilerplate; not actual network/exec behavior. ai
semgrep semgrep:eval-usage AI (semgrep): All eval() hits are in the webpack UMD bundle using webpack's eval devtool mode to embed module source strings — a standard build artifact, not malicious code execution. ai
phantom-deps phantom-dep:@types/prop-types AI (phantom-deps): @types/prop-types is legitimately used as a runtime dep for TypeScript type declarations shipped with the package. Not a phantom dependency in practice. ai
semgrep semgrep:new-function-constructor AI (semgrep): Standard webpack/core-js global-this detection pattern: new Function('return this')(). Ubiquitous in bundled code. ai
source-diff net-exec-file:umd/react-json-tree.js AI (source-diff): Standard webpack UMD bundle boilerplate; module detection and __webpack_require__ trigger false positive for net+exec. ai
source-diff net-exec-file:umd/react-json-tree.min.js AI (source-diff): Minified version of the same webpack UMD bundle; same false positive pattern. ai
phantom-deps phantom-dep:babel-plugin-transform-runtime AI (phantom-deps): babel-plugin-transform-runtime is used via .babelrc config, not direct imports; this is expected for Babel plugins. ai
provenance publisher-changed AI (provenance): Legitimate maintainer transition from gaearon to alexkuz in 2016; both are established React ecosystem contributors. alexkuz has published all subsequent versions. ai
bogus-package bogus-package AI (bogus-package): gaearon (Dan Abramov) is a well-known React core team member, not a spam publisher. False positive on S_KNOWN_SPAM_PUBLISHER. ai
phantom-deps phantom-dep:@types/lodash AI (phantom-deps): @types/lodash provides TypeScript type declarations; it's used at compile time, not directly imported at runtime. ai
provenance missing-githead AI (provenance): Monorepo publish tooling changes commonly drop gitHead; publisher is a long-standing trusted maintainer of redux-devtools. ai

Versions (showing 51 of 59)

View all versions
Version Deps Published
0.20.0 2 / 9
0.19.0 2 / 16
0.18.0 3 / 31
0.17.0 5 / 31
0.16.2 4 / 30
0.16.1 4 / 30
0.16.0 4 / 29
0.15.2 3 / 26
0.15.1 3 / 27
0.15.0 3 / 4
0.14.0 3 / 4
0.13.0 3 / 4
0.12.1 2 / 13
0.12.0 2 / 14
0.11.2 3 / 34
0.11.1 3 / 30
0.11.0 3 / 30
0.10.9 3 / 26
0.10.7 2 / 26
0.10.6 2 / 26
0.10.5 3 / 26
0.10.4 3 / 25
0.10.3 3 / 25
0.10.2 3 / 25
0.10.1 3 / 25
0.10.0 4 / 24
0.9.0 4 / 24
0.8.2 4 / 24
0.8.1 4 / 24
0.8.0 4 / 23
0.7.4 4 / 23
0.7.3 4 / 23
0.7.2 4 / 23
0.7.1 4 / 23
0.7.0 4 / 23
0.6.8 4 / 17
0.6.7 4 / 17
0.6.6 4 / 17
0.6.5 4 / 17
0.6.4 4 / 17
0.6.3 4 / 17
0.6.2 4 / 15
0.6.1 4 / 15
0.6.0 4 / 15
0.5.6 3 / 15
0.5.5 3 / 15
0.5.3 3 / 15
0.5.2 2 / 15
0.5.1 2 / 15
0.5.0 2 / 15
0.4.0 2 / 11

v0.20.0

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: methuselah96.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.19.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: methuselah96.

v0.18.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: methuselah96.

v0.17.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: methuselah96.

v0.16.2

3 findings
HIGH New file with network + code execution: lib/umd/react-json-tree.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: lib/umd/react-json-tree.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.1

3 findings
HIGH New file with network + code execution: lib/umd/react-json-tree.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: lib/umd/react-json-tree.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.0

3 findings
HIGH New file with network + code execution: dist/react-json-tree.umd.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/react-json-tree.umd.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

3 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: methuselah96.

INFO Publisher changed: zalmoxisus → methuselah96 (on 2020-07-30) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-07-30. This could indicate a legitimate maintainer transition or an account compromise.

v0.11.2

4 findings
HIGH New file with network + code execution: umd/react-json-tree.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: umd/react-json-tree.min.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: zalmoxisus.

v0.11.1

3 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: zalmoxisus.

INFO Publisher changed: alexkuz → zalmoxisus (on 2018-12-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2018-12-21. This could indicate a legitimate maintainer transition or an account compromise.

v0.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.6

2 findings
HIGH Publisher changed: gaearon → alexkuz (on 2016-04-16) provenance

This version was published by a different npm account than previous versions on 2016-04-16. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.4

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: chibicode → gaearon (on 2016-04-02) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2016-04-02. This could indicate a legitimate maintainer transition or an account compromise.

v0.6.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.