← Home

storybook

npm Repository Homepage

Storybook: Develop, document, and test UI components in isolation

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

ndelangentmeasdayghengeveldkasperpeulenshilmanjreinholdvalentinpalkovicstorybook-bot

Keywords

storybookcomponentcomponentsdesign-systemscomponent-testingreactnextnext.jsreact-nativereact-native-webvueangularsveltesveltekitweb-components

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff net-exec-file:dist/_node-chunks/chunk-UTMZDFPP.js AI (source-diff): Esbuild-bundled chunk with CJS compat shim; standard Storybook build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-QOQQSFOP.js AI (source-diff): Esbuild-bundled chunk with CJS compat shim; standard Storybook build output. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-5MEJYN36.js AI (source-diff): Esbuild-bundled chunk with CJS compat shim; standard Storybook build output. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-ML5UXL3U.js AI (source-diff): Esbuild-bundled chunk with CJS compat shim; expected for Storybook's build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-4CKOOAKX.js AI (source-diff): Esbuild-bundled chunk with CJS compat shim; expected for Storybook's build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-3FBJJ3J7.js AI (source-diff): Esbuild-bundled chunk with CJS compat shim; expected for Storybook's build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-YPTE6EJM.js AI (source-diff): Bundled Babel types chunk; CJS compat + network is normal for Storybook core. ai
publish-pattern rapid-publish AI (publish-pattern): CI-driven releases from GitHub Actions; rapid publish is normal for this project. ai
source-diff net-exec-file:dist/_node-chunks/chunk-QTJ23TAE.js AI (source-diff): Bundled utility chunk with CJS compat shims; expected pattern for this package. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-S4AMI67M.js AI (source-diff): Bundled dev-server chunk; network+exec is inherent to Storybook's builder functionality. ai
source-diff net-exec-file:dist/_node-chunks/chunk-FL7EBVLJ.js AI (source-diff): esbuild-bundled chunk with vendored deps; expected build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-6YHOQD7F.js AI (source-diff): esbuild-bundled chunk with vendored Babel types; expected build output. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-LFGO35U5.js AI (source-diff): esbuild-bundled chunk with vendored deps; expected for Storybook's build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-CXHD3UA6.js AI (source-diff): Bundled babel/types chunk with CJS compat shim; standard Storybook build output. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-H3RE756K.js AI (source-diff): Bundled esbuild output with CJS compat shim; expected for Storybook's builder-manager chunk. ai
source-diff net-exec-file:dist/_node-chunks/chunk-PNYLLFX3.js AI (source-diff): Bundled chunk with CJS compat shim; standard Storybook build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-WKCYHYMS.js AI (source-diff): Bundled build-tool chunk with expected network+require patterns; stable FP for storybook. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-SBMOFRIH.js AI (source-diff): Bundled build-tool chunk with expected network+require patterns; stable FP for storybook. ai
source-diff net-exec-file:dist/_node-chunks/chunk-WOCJUYI6.js AI (source-diff): Bundled build-tool chunk with expected network+require patterns; stable FP for storybook. ai
source-diff net-exec-file:dist/_node-chunks/mdx-N42X6CFJ-63AUQLMU.js AI (source-diff): MDX compiler chunk with node APIs; expected for docs processing. ai
source-diff net-exec-file:dist/_node-chunks/chunk-MKXM7JNE.js AI (source-diff): Bundled babel types/transforms chunk; standard build output. ai
source-diff net-exec-file:dist/_node-chunks/chunk-H4PWFMMO.js AI (source-diff): Core server chunk with node APIs; expected for Storybook's dev server. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-UBFFXMB4.js AI (source-diff): Builder-manager with bundled ejs/node APIs is core Storybook functionality. ai
source-diff obfuscated-file:dist/_node-chunks/mdx-N42X6CFJ-63AUQLMU.js AI (source-diff): Bundled acorn/MDX parser output from esbuild; expected for this package. ai
source-diff obfuscated-file:dist/_browser-chunks/syntaxhighlighter-OH4MV7E3.js AI (source-diff): Minified syntax-highlighter grammars bundled by esbuild; standard for Storybook. ai
source-diff large-new-source-files AI (source-diff): Storybook bundles many deps into dist chunks; large file count is normal. ai
source-diff net-exec-file:dist/_node-chunks/chunk-JXXWBFBF.js AI (source-diff): Same Storybook esbuild CJS compat banner pattern; bundled @babel/types and related libs, no malicious patterns. ai
source-diff net-exec-file:dist/_node-chunks/builder-manager-EYIS5ER3.js AI (source-diff): Storybook's esbuild build process bundles deps into node chunks with CJS compat banners; network+exec pattern is from bundled libs (ejs, babel), not malware. ai
source-diff net-exec-file:dist/_node-chunks/chunk-GOY6UMCB.js AI (source-diff): Same Storybook esbuild CJS compat banner pattern; bundled third-party libs, no malicious network/exec patterns. ai
phantom-deps phantom-dep:@testing-library/user-event AI (phantom-deps): Testing library loaded by convention in Storybook test setup; stable false positive. ai
phantom-deps phantom-dep:@testing-library/jest-dom AI (phantom-deps): Testing library loaded by convention in Storybook test setup; stable false positive. ai
phantom-deps phantom-dep:@vitest/expect AI (phantom-deps): Testing framework package loaded by convention; stable false positive for this package. ai
phantom-deps phantom-dep:@vitest/spy AI (phantom-deps): Testing framework package loaded by convention in Storybook's test utilities; not a real phantom dep concern. ai
source-diff obfuscated-file:dist/_node-chunks/mdx-N42X6CFJ-ODHTGV2Q.js AI (source-diff): Long lines are acorn parser Unicode character code data arrays — a well-known pattern in JS parsers, not obfuscation. ai
source-diff net-exec-file:dist/_node-chunks/mdx-N42X6CFJ-ODHTGV2Q.js AI (source-diff): Bundled @storybook/docs-mdx with acorn parser; long lines are Unicode char code arrays from acorn, not obfuscation. ai

Versions (showing 51 of 244)

Show 433 prereleases View all versions
Version Deps Published
10.4.5 15 / 139
10.4.4 15 / 139
10.4.3 15 / 139
10.4.2 15 / 139
10.4.1 15 / 139
10.4.0 15 / 139
10.3.6 13 / 131
10.3.5 13 / 131
10.3.4 13 / 131
10.3.3 12 / 131
10.3.2 12 / 131
10.3.1 12 / 131
10.3.0 12 / 131
10.2.19 12 / 130
10.2.18 12 / 130
10.2.17 12 / 130
10.2.16 12 / 130
10.2.15 12 / 129
10.2.14 12 / 129
10.2.13 12 / 129
10.2.12 12 / 129
10.2.11 12 / 129
10.2.10 12 / 129
9.1.20 12 / 129
9.1.19 12 / 128
8.6.18 1 / 1
8.6.17 1 / 1
8.0.8 1 / 0
8.0.7 1 / 0
8.0.6 1 / 0
8.0.5 1 / 0
8.0.4 1 / 0
8.0.3 1 / 0
8.0.2 1 / 0
8.0.1 1 / 0
8.0.0 1 / 0
7.6.24 1 / 0
7.6.23 1 / 0
7.6.22 1 / 0
7.6.21 1 / 0
7.6.17 1 / 0
7.6.16 1 / 0
7.6.15 1 / 0
7.6.14 1 / 0
7.6.13 1 / 0
7.6.12 1 / 0
7.6.11 1 / 0
7.6.10 1 / 0
7.6.9 1 / 0
7.6.8 1 / 0
7.6.7 1 / 0

v10.4.5

4 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-5MEJYN36.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-QOQQSFOP.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-UTMZDFPP.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.4.4

4 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-ML5UXL3U.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-3FBJJ3J7.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-4CKOOAKX.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.4.3

4 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-S4AMI67M.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-QTJ23TAE.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-YPTE6EJM.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.4.2

4 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-LFGO35U5.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-6YHOQD7F.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-FL7EBVLJ.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.4.1

4 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-H3RE756K.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-CXHD3UA6.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-PNYLLFX3.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.4.0

4 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-SBMOFRIH.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-WKCYHYMS.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-WOCJUYI6.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.3.5

6 findings
HIGH New file with network + code execution: dist/_node-chunks/builder-manager-EYIS5ER3.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-GOY6UMCB.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: dist/_node-chunks/chunk-JXXWBFBF.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/_node-chunks/mdx-N42X6CFJ-ODHTGV2Q.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/_node-chunks/mdx-N42X6CFJ-ODHTGV2Q.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v10.3.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v10.2.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.1.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v9.1.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v8.6.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v8.6.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.24

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v7.6.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.