← Home

tss-react

npm Repository Homepage
14
Versions
—
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

garronej

Keywords

jsshooksreact@material-uimuicssmakeStyleswithStyles

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Transition from garronej to GitHub Actions CI is intentional; SLSA attestation confirms the same repo/org controls publishing. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy followed by CI-attested publish from the same repo is consistent with a tooling migration, not takeover. ai

Versions (showing 14 of 14)

Version Deps Published
4.9.21 3 / 20
4.9.20 3 / 20
4.9.19 3 / 20
4.9.18 3 / 20
4.9.17 3 / 20
4.9.16 3 / 20
4.9.15 3 / 20
4.9.14 3 / 20
4.9.13 3 / 20
4.9.12 3 / 20
4.9.11 3 / 20
4.9.10 3 / 20
4.9.9 3 / 20
4.9.8 3 / 20

v4.9.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.9.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.9.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.