recharts
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from manual publish to GitHub Actions CI/CD with SLSA attestation; legitimate automation adoption. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() in createEventProxy.js is idiomatic Proxy handler code for transparent event forwarding — not obfuscation. Stable pattern for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Recharts has 282 versions and 50.5M weekly downloads; it is not dormant. The finding reflects a publisher account gap, not package inactivity. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 159 new files correspond to the added omnidoc documentation generation subsystem, consistent with the new omnidoc script in package.json. No malicious indicators. | ai | |
| dependencies | unvetted-dep:decimal.js-light | AI (dependencies): decimal.js-light is a well-known decimal arithmetic library with no malicious history; appropriate dependency for a charting library. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in umd/Recharts.js is standard webpack UMD bundle boilerplate, not a malicious dynamic code execution pattern. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:victory-vendor | AI (dependencies): victory-vendor is a legitimate dependency from the Formidable/victory charting ecosystem, appropriate for a charting library like recharts. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 3.10.1 | 11 / 93 | |
| 3.10.0 | 11 / 93 | |
| 3.9.2 | 11 / 93 | |
| 3.9.1 | 11 / 93 | |
| 3.9.0 | 11 / 93 | |
| 3.8.1 | 11 / 91 | |
| 3.8.0 | 11 / 91 | |
| 3.7.0 | 11 / 85 | |
| 3.6.0 | 11 / 85 | |
| 3.5.1 | 11 / 82 | |
| 3.4.1 | 11 / 80 | |
| 3.4.0 | 11 / 80 | |
| 3.3.0 | 11 / 81 | |
| 3.2.1 | 11 / 81 | |
| 3.2.0 | 11 / 81 | |
| 3.1.2 | 11 / 78 | |
| 3.1.1 | 11 / 78 | |
| 3.1.0 | 11 / 86 | |
| 3.0.2 | 11 / 85 | |
| 3.0.1 | 11 / 85 | |
| 3.0.0 | 11 / 86 |
v3.10.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.10.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.2
2 findingsThis version was published by a different npm account than previous versions on 2026-07-04. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.9.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.