@ant-design/colors
Color palettes calculator of Ant Design
16
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
afc163zombiejchenshuai2144arvinxxmadcccranranup123
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer list cleanup during major version bump within the Ant Design org; publisher zombiej is a trusted long-term contributor. | ai | |
| provenance | publisher-changed | AI (provenance): Both afc163 and zombiej are long-standing Ant Design team members; intra-team publisher rotation is expected for this org-scoped package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Maintainer expansion on an established Ant Design package; consistent with ecosystem growth and team collaboration. | ai | |
| phantom-deps | phantom-dep:tslint | AI (phantom-deps): tslint was accidentally placed in dependencies instead of devDependencies; it is not imported at runtime. Benign packaging mistake consistent across versions of this package. | ai | |
| dependencies | unvetted-dep:tslint | AI (dependencies): tslint is a dev linting tool mistakenly listed as a runtime dep; not actually used at runtime. No security risk for this package. | ai | |
| dependencies | unvetted-dep:tinycolor2 | AI (dependencies): tinycolor2 is a legitimate, widely-used color library; appropriate dependency for a color palette calculator. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @ant-design/colors is a scoped package from the official Ant Design org, not a typosquat of cors. Levenshtein match is spurious. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 4M weekly downloads and a trusted publisher; lack of Sigstore provenance is not a meaningful risk signal here. | ai |