@ant-design/icons
[](https://npmjs.org/package/@ant-design/icons) [](https://npmjs.org/package/@ant-design/icons)
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:es/icons/AmazonCircleFilled.d.ts | AI (source-diff): Base64 data URIs in JSDoc comments are SVG icon previews for IDE hover — standard pattern in icon libraries, not obfuscation. | ai | |
| source-diff | obfuscated-file:es/icons/AmazonSquareFilled.d.ts | AI (source-diff): Base64 data URIs in JSDoc comments are SVG icon previews for IDE hover — standard pattern in icon libraries, not obfuscation. | ai | |
| source-diff | obfuscated-file:es/icons/AmazonOutlined.d.ts | AI (source-diff): Base64 data URIs in JSDoc comments are SVG icon previews for IDE hover — standard pattern in icon libraries, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/icons/HolderOutlined.d.ts | AI (source-diff): TypeScript declaration files with complex React prop type unions naturally produce long single-line definitions; not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/icons/HolderOutlined.d.ts | AI (source-diff): TypeScript .d.ts files with long Pick union types are normal for React component libraries; not obfuscation. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Babel runtime is a framework convention for transpiled packages; stable for this package. | ai | |
| source-diff | obfuscated-file:es/icons/BilibiliOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:lib/icons/KubernetesOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:es/icons/LinuxOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:lib/icons/LinuxOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:lib/icons/BilibiliOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:es/icons/DiscordOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:lib/icons/DiscordOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| source-diff | obfuscated-file:es/icons/KubernetesOutlined.js | AI (source-diff): Auto-generated icon component with embedded base64 SVG data; not obfuscated malware. Build artifact from documented generate.ts script. | ai | |
| dependencies | unvetted-peer-dep:react-dom | AI (dependencies): react-dom peer dependency is expected for React icon library; stable for this package. | ai | |
| dependencies | unvetted-dep:rc-util | AI (dependencies): rc-util is a standard Ant Design ecosystem dependency; stable for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore adoption; no provenance is expected for this era. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dependencies are all established packages (rc-util, classnames, insert-css, @ant-design/colors, @ant-design/icons-svg); no suspicious additions. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects expanded icon set and build artifacts; legitimate for icon library growth. | ai | |
| provenance | missing-githead | AI (provenance): gitHead absence reflects publish environment change, not code integrity risk for a mature package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Maintainer transition is legitimate; vagusx is listed as contributor and has established npm history. | ai | |
| source-diff | obfuscated-file:lib/umd.js | AI (source-diff): Standard webpack UMD bundle of SVG icon data; build:umd script in package.json confirms this is a legitimate build artifact. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 210 new files reflect major version bump (v4→v5); consistent with feature additions, not injection. | ai | |
| source-diff | obfuscated-file:lib/Amazon.js | AI (source-diff): SVG icon data files have very long path coordinate strings triggering the long-line heuristic. Not obfuscation — standard for icon libraries. | ai | |
| source-diff | obfuscated-file:lib/dist.js | AI (source-diff): UMD webpack bundle of SVG icon definitions; long lines are SVG path data, not obfuscation. Matches build:umd script. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change reflects legitimate maintainer transition; vagusx has 2457-day history and 115 approved packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Team expansion on established package; new maintainer addition is normal for popular projects. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped @ant-design namespace with official GitHub repo; Levenshtein distance match is a false positive for this established ecosystem package. | ai | |
| dependencies | unvetted-dep:@rc-component/util | AI (dependencies): @rc-component/util is a utility package from the RC ecosystem; reasonable constraint and low risk for this established package. | ai | |
| dependencies | unvetted-dep:@ant-design/colors | AI (dependencies): @ant-design/colors is a first-party Ant Design package; its use here is expected and stable across versions. | ai |
Versions (showing 81 of 81)
| Version | Deps | Published |
|---|---|---|
| 6.2.5 | 4 / 32 | |
| 6.2.4 | 4 / 32 | |
| 6.2.3 | 4 / 32 | |
| 6.2.2 | 4 / 32 | |
| 6.2.1 | 4 / 32 | |
| 6.2.0 | 4 / 32 | |
| 6.1.1 | 4 / 34 | |
| 6.1.0 | 4 / 35 | |
| 6.0.2 | 4 / 36 | |
| 6.0.1 | 4 / 37 | |
| 6.0.0 | 4 / 37 | |
| 5.6.1 | 5 / 36 | |
| 5.6.0 | 5 / 36 | |
| 5.5.2 | 5 / 36 | |
| 5.5.1 | 5 / 36 | |
| 5.5.0 | 5 / 36 | |
| 5.4.0 | 5 / 38 | |
| 5.3.7 | 5 / 38 | |
| 5.3.6 | 5 / 38 | |
| 5.3.5 | 5 / 37 | |
| 5.3.4 | 5 / 37 | |
| 5.3.3 | 5 / 37 | |
| 5.3.2 | 5 / 37 | |
| 5.3.1 | 5 / 37 | |
| 5.3.0 | 5 / 37 | |
| 5.2.0 | 5 / 37 | |
| 5.1.4 | 5 / 36 | |
| 5.1.3 | 5 / 36 | |
| 5.1.2 | 5 / 36 | |
| 5.1.1 | 5 / 36 | |
| 5.1.0 | 5 / 28 | |
| 5.0.1 | 5 / 28 | |
| 5.0.0 | 5 / 27 | |
| 4.8.0 | 5 / 27 | |
| 4.7.0 | 5 / 24 | |
| 4.6.4 | 5 / 24 | |
| 4.6.3 | 5 / 24 | |
| 4.6.2 | 5 / 24 | |
| 4.6.1 | 5 / 24 | |
| 4.6.0 | 5 / 24 | |
| 4.5.0 | 6 / 25 | |
| 4.4.0 | 6 / 25 | |
| 4.3.0 | 6 / 24 | |
| 4.2.2 | 6 / 24 | |
| 4.2.1 | 6 / 23 | |
| 4.2.0 | 5 / 23 | |
| 4.1.0 | 5 / 22 | |
| 4.0.6 | 5 / 22 | |
| 4.0.5 | 5 / 22 | |
| 4.0.4 | 5 / 22 | |
| 4.0.3 | 5 / 22 | |
| 4.0.2 | 5 / 22 | |
| 4.0.1 | 5 / 22 | |
| 4.0.0 | 5 / 22 | |
| 2.1.1 | 0 / 52 | |
| 2.1.0 | 0 / 52 | |
| 2.0.1 | 0 / 52 | |
| 2.0.0 | 0 / 52 | |
| 1.2.1 | 0 / 52 | |
| 1.2.0 | 0 / 52 | |
| 1.1.16 | 0 / 52 | |
| 1.1.15 | 0 / 52 | |
| 1.1.14 | 0 / 52 | |
| 1.1.13 | 0 / 52 | |
| 1.1.12 | 0 / 52 | |
| 1.1.11 | 0 / 52 | |
| 1.1.10 | 0 / 52 | |
| 1.1.9 | 0 / 52 | |
| 1.1.8 | 0 / 52 | |
| 1.1.7 | 0 / 52 | |
| 1.1.6 | 0 / 52 | |
| 1.1.5 | 0 / 52 | |
| 1.1.4 | 0 / 52 | |
| 1.1.3 | 0 / 52 | |
| 1.1.2 | 0 / 52 | |
| 1.1.1 | 0 / 52 | |
| 1.1.0 | 0 / 52 | |
| 1.0.3 | 0 / 52 | |
| 1.0.2 | 0 / 52 | |
| 1.0.1 | 0 / 52 | |
| 1.0.0 | 0 / 52 |
v6.2.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.4
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (afc163) than the most recent previously approved version (zombiej) on 2026-05-28, but afc163 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v6.2.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.2
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-05-29. This could indicate a legitimate maintainer transition or an account compromise.
v4.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2020-02-28. This could indicate a legitimate maintainer transition or an account compromise.