react-scan
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:tsup | AI (phantom-deps): tsup is the build tool, referenced via config as expected. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Legitimate long-running package; 0.0.0 is its actual initial version, not throwaway pattern. | ai | |
| bogus-package | bogus-package | AI (bogus-package): High-download, well-known package; spam heuristics are false positives here. | ai | |
| provenance | publisher-changed-stale | AI (provenance): 584 days stable on npm; consistent with legitimate maintainer handoff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Long-stable transfer, no takedown, high trust ecosystem history. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All well-known, established packages supporting new monitoring features. | ai | |
| source-diff | obfuscated-file:dist/cli.mjs | AI (source-diff): tsup-minified CLI build output; ESM twin of cli.js, benign. | ai | |
| source-diff | obfuscated-file:dist/cli.js | AI (source-diff): tsup-minified CLI build output; legit Playwright launcher, no malicious behavior. | ai | |
| dependencies | unvetted-dep:@pivanov/utils | AI (dependencies): Same maintainer's own utility package, not third-party. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): Used in build/config tooling, not source imports. | ai | |
| phantom-deps | phantom-dep:@clack/core | AI (phantom-deps): CLI tooling used via config, not direct import. | ai | |
| phantom-deps | phantom-dep:@pivanov/utils | AI (phantom-deps): Same maintainer's package, loaded by convention. | ai | |
| provenance | missing-githead | AI (provenance): Well-established package with clean history; single missing gitHead is low risk without other malware signals. | ai | |
| phantom-deps | phantom-dep:react-grab | AI (phantom-deps): react-grab is declared but not directly imported; phantom-dep finding confirms it's not used in code. | ai | |
| phantom-deps | phantom-dep:@babel/generator | AI (phantom-deps): Referenced in config/build tooling; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:estree-walker | AI (phantom-deps): Referenced in config/build tooling; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Framework-scoped type package; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Established package with public GitHub repo; lack of Sigstore attestation is common and not a risk signal here. | ai |
Versions (showing 51 of 67)
| Version | Deps | Published |
|---|---|---|
| 1.2.0 | 13 / 19 | |
| 0.5.7 | 11 / 21 | |
| 0.5.6 | 10 / 20 | |
| 0.5.5 | 10 / 20 | |
| 0.5.4 | 13 / 20 | |
| 0.5.3 | 13 / 19 | |
| 0.5.2 | 13 / 19 | |
| 0.5.1 | 13 / 19 | |
| 0.5.0 | 13 / 19 | |
| 0.1.3 | 17 / 21 | |
| 0.1.2 | 18 / 21 | |
| 0.1.1 | 16 / 20 | |
| 0.1.0 | 16 / 20 | |
| 0.0.54 | 16 / 22 | |
| 0.0.53 | 16 / 22 | |
| 0.0.52 | 16 / 22 | |
| 0.0.51 | 17 / 25 | |
| 0.0.50 | 16 / 25 | |
| 0.0.49 | 16 / 25 | |
| 0.0.48 | 16 / 25 | |
| 0.0.47 | 16 / 23 | |
| 0.0.46 | 16 / 22 | |
| 0.0.45 | 16 / 22 | |
| 0.0.44 | 15 / 22 | |
| 0.0.43 | 15 / 22 | |
| 0.0.42 | 16 / 22 | |
| 0.0.41 | 16 / 22 | |
| 0.0.40 | 16 / 22 | |
| 0.0.39 | 16 / 22 | |
| 0.0.38 | 16 / 22 | |
| 0.0.37 | 16 / 22 | |
| 0.0.36 | 5 / 11 | |
| 0.0.35 | 5 / 11 | |
| 0.0.34 | 5 / 11 | |
| 0.0.33 | 5 / 11 | |
| 0.0.32 | 5 / 11 | |
| 0.0.31 | 5 / 11 | |
| 0.0.30 | 5 / 11 | |
| 0.0.29 | 5 / 11 | |
| 0.0.28 | 5 / 11 | |
| 0.0.27 | 5 / 11 | |
| 0.0.26 | 5 / 11 | |
| 0.0.25 | 5 / 11 | |
| 0.0.24 | 5 / 11 | |
| 0.0.23 | 5 / 11 | |
| 0.0.22 | 5 / 11 | |
| 0.0.21 | 5 / 11 | |
| 0.0.20 | 5 / 11 | |
| 0.0.19 | 5 / 11 | |
| 0.0.18 | 5 / 11 | |
| 0.0.17 | 5 / 11 |
v0.1.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (pivanov) than the most recent previously approved version (robpruzan) on 2025-02-02, but pivanov is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.1.2
3 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: pivanov.
This version was published by a different npm account (pivanov) than the most recent previously approved version (robpruzan) on 2025-02-02, but pivanov is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.52
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (abai) than the most recent previously approved version (robpruzan) on 2024-12-22, but abai is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.51
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (robpruzan) than the most recent previously approved version (abai) on 2024-12-19, but robpruzan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.50
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (abai) than the most recent previously approved version (robpruzan) on 2024-12-17, but abai is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.49
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (robpruzan) than the most recent previously approved version (abai) on 2024-12-17, but robpruzan is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.0.48
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.47
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.46
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.45
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.44
2 findingsThis version was published by a different npm account (robpruzan) than the most recent previously approved version (abai) on 2024-12-11. It has since remained available on npm for 583 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.43
2 findingsThis version was published by a different npm account (robpruzan) than the most recent previously approved version (abai) on 2024-12-11. It has since remained available on npm for 584 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.42
2 findingsThis version was published by a different npm account (robpruzan) than the most recent previously approved version (abai) on 2024-12-09. It has since remained available on npm for 586 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.41
2 findingsThis version was published by a different npm account (robpruzan) than the most recent previously approved version (abai) on 2024-12-08. It has since remained available on npm for 587 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.40
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.39
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.38
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.37
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.36
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.35
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.34
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.33
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.32
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.31
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.30
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.29
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.28
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.27
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.26
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.25
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.24
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.23
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.22
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.21
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.20
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.19
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.18
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.17
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.