@abp/star-rating-svg
ABP Framework is a complete open-source infrastructure to create modern web applications by following the best practices and conventions of software development. This package is a part of the [ABP Framework](https://abp.io) and contains client-side files.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Established ABP framework package; provenance absence is consistent across all its npm packages. | ai | |
| dependencies | unvetted-dep:star-rating-svg | AI (dependencies): star-rating-svg is a declared, expected dependency for this wrapper package; stable pattern across ABP versions. | ai | |
| bogus-package | bogus-package | AI (bogus-package): ABP framework uses thin wrapper packages with asset-only payloads; link-dump README and tiny payload are structural, not malicious. | ai | |
| phantom-deps | phantom-dep:@abp/jquery | AI (phantom-deps): Same-org peer dependency pattern for ABP framework; not a real phantom dep concern. | ai | |
| phantom-deps | phantom-dep:star-rating-svg | AI (phantom-deps): Referenced in config files per finding; consistent with asset-bundling wrapper pattern. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 10.4.0 | 2 / 0 | |
| 10.3.0 | 2 / 0 | |
| 10.2.1 | 2 / 0 | |
| 10.2.0 | 2 / 0 | |
| 10.0.1 | 2 / 0 |
v10.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v10.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v10.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v10.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.