react-native-macos
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:jsc-android | AI (phantom-deps): jsc-android is a platform-specific peer dep referenced in config; stable false positive for this package. | ai | |
| semgrep | semgrep:child-process-exec | AI (semgrep): exec() in runMacOS.js opens macOS apps by bundle ID — standard CLI toolchain behavior for a React Native macOS build tool. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): spawn() in runMacOS.js invokes xcpretty for Xcode build output — expected behavior for a macOS build CLI tool. | ai | |
| phantom-deps | phantom-dep:@react-native/virtualized-lists | AI (phantom-deps): react-native-macos uses its own fork (@react-native-macos/virtualized-lists); declaring the upstream as a dep is a known compatibility pattern for this package. | ai | |
| provenance | no-provenance | AI (provenance): Microsoft's react-native-macos is a well-established package with 54 approved-dep edges and automated publishing; lack of Sigstore provenance is not a disqualifier here. | ai | |
| phantom-deps | phantom-dep:babel-jest | AI (phantom-deps): babel-jest is referenced in jest config files; phantom-dep detection is a false positive for config-file-only references in large frameworks. | ai | |
| phantom-deps | phantom-dep:flow-enums-runtime | AI (phantom-deps): flow-enums-runtime is a Flow type system runtime dependency referenced in config; expected for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env in runMacOS.js CLI tool is standard practice for passing developer environment to child processes. Not credential exfiltration. | ai | |
| phantom-deps | phantom-dep:babel-plugin-syntax-hermes-parser | AI (phantom-deps): Referenced in Babel config files; phantom-dep detection is a false positive for config-file-only references. | ai | |
| phantom-deps | phantom-dep:@react-native/gradle-plugin | AI (phantom-deps): Platform-specific binary package for Android/Gradle builds; not directly imported in JS but legitimately declared. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in loadBundleFromServer.js is React Native's intentional dev-mode hot reload mechanism, explicitly marked with eslint-disable and well-documented. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process usage in a CLI tool (cli.js) is expected for spawning build tools, packagers, and simulators. Standard for React Native CLI. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in cli.js delegates to @react-native-community/cli after resolving its path — standard CLI delegation pattern for React Native. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a legitimate declared dependency used in config/platform-specific contexts in this large framework package. | ai |
Versions (showing 51 of 216)
| Version | Deps | Published |
|---|---|---|
| 0.81.9 | 34 / 0 | |
| 0.81.8 | 34 / 0 | |
| 0.81.7 | 34 / 0 | |
| 0.81.6 | 34 / 0 | |
| 0.81.5 | 34 / 0 | |
| 0.81.4 | 34 / 0 | |
| 0.81.3 | 34 / 0 | |
| 0.81.2 | 34 / 0 | |
| 0.81.1 | 34 / 0 | |
| 0.81.0 | 34 / 0 | |
| 0.79.4 | 37 / 0 | |
| 0.79.1 | 37 / 0 | |
| 0.79.0 | 37 / 0 | |
| 0.78.6 | 36 / 0 | |
| 0.78.5 | 36 / 0 | |
| 0.78.4 | 36 / 0 | |
| 0.78.3 | 36 / 0 | |
| 0.78.2 | 37 / 0 | |
| 0.78.1 | 37 / 0 | |
| 0.78.0 | 37 / 0 | |
| 0.77.7 | 37 / 0 | |
| 0.77.6 | 37 / 0 | |
| 0.77.5 | 37 / 0 | |
| 0.77.4 | 37 / 0 | |
| 0.77.3 | 37 / 0 | |
| 0.77.2 | 37 / 0 | |
| 0.77.1 | 37 / 0 | |
| 0.77.0 | 37 / 0 | |
| 0.76.12 | 38 / 0 | |
| 0.76.11 | 38 / 0 | |
| 0.76.10 | 38 / 0 | |
| 0.76.9 | 38 / 0 | |
| 0.76.8 | 38 / 0 | |
| 0.76.7 | 38 / 0 | |
| 0.76.6 | 38 / 0 | |
| 0.76.5 | 38 / 0 | |
| 0.76.4 | 38 / 0 | |
| 0.76.3 | 38 / 0 | |
| 0.76.2 | 38 / 0 | |
| 0.76.1 | 38 / 0 | |
| 0.76.0 | 38 / 0 | |
| 0.75.34 | 39 / 0 | |
| 0.75.33 | 39 / 0 | |
| 0.75.32 | 39 / 0 | |
| 0.75.31 | 39 / 0 | |
| 0.75.30 | 39 / 0 | |
| 0.75.29 | 39 / 0 | |
| 0.75.28 | 39 / 0 | |
| 0.75.27 | 39 / 0 | |
| 0.75.26 | 40 / 0 | |
| 0.75.25 | 40 / 0 |
v0.81.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.78.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.77.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.76.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.75.27
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.75.26
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.75.25
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.