@storybook/ui — Greenflagged

Core Storybook UI

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

shilmanndelangenhypnosphitmeasdayigor-dv

Keywords

storybook

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:history	AI (phantom-deps): Phantom dependency is legitimate for this package; likely used transitively through @storybook/* dependencies.	ai	2026/04/24
phantom-deps	phantom-dep:react-lifecycles-compat	AI (phantom-deps): Phantom dependency is legitimate; used for React compatibility through transitive dependencies.	ai	2026/04/24
phantom-deps	phantom-dep:lodash.throttle	AI (phantom-deps): Phantom dependency is legitimate; used in event handling through transitive dependencies.	ai	2026/04/24
phantom-deps	phantom-dep:lodash.sortby	AI (phantom-deps): Phantom dependency is legitimate; used in data processing through transitive dependencies.	ai	2026/04/24
phantom-deps	phantom-dep:react-modal	AI (phantom-deps): Phantom dependency is legitimate; used in modal UI components through transitive dependencies.	ai	2026/04/24
phantom-deps	phantom-dep:keycode	AI (phantom-deps): Phantom dependency is legitimate; used in UI event handling through transitive dependencies.	ai	2026/04/24
phantom-deps	phantom-dep:qs	AI (phantom-deps): Declared in package.json; phantom-dep pattern is expected for Storybook monorepo packages.	ai	2026/04/24
phantom-deps	phantom-dep:telejson	AI (phantom-deps): Declared in package.json; phantom-dep pattern is expected for Storybook monorepo packages.	ai	2026/04/24
phantom-deps	phantom-dep:util-deprecate	AI (phantom-deps): Declared in package.json; phantom-dep pattern is expected for Storybook monorepo packages.	ai	2026/04/24
phantom-deps	phantom-dep:emotion-theming	AI (phantom-deps): Declared in package.json; phantom-dep pattern is expected for Storybook monorepo packages.	ai	2026/04/24
phantom-deps	phantom-dep:fast-deep-equal	AI (phantom-deps): Declared in package.json; phantom-dep pattern is expected for Storybook monorepo packages.	ai	2026/04/24
typosquat	typosquat.levenshtein:uuid	AI (typosquat): @storybook/ui is a scoped package in the official Storybook org; Levenshtein comparison to 'uuid' is a false positive with no plausible confusion.	ai	2026/04/24
typosquat	typosquat.levenshtein:qs	AI (typosquat): @storybook/ui is a scoped package in the official Storybook org; Levenshtein comparison to 'qs' is a false positive with no plausible confusion.	ai	2026/04/24
typosquat	typosquat.levenshtein:joi	AI (typosquat): @storybook/ui is a scoped package in the official Storybook org; Levenshtein comparison to 'joi' is a false positive with no plausible confusion.	ai	2026/04/24
typosquat	typosquat.levenshtein:yup	AI (typosquat): @storybook/ui is a scoped package in the official Storybook org; Levenshtein comparison to 'yup' is a false positive with no plausible confusion.	ai	2026/04/24
typosquat	typosquat.levenshtein:pg	AI (typosquat): @storybook/ui is a scoped package in the official Storybook org; Levenshtein comparison to 'pg' is a false positive with no plausible confusion.	ai	2026/04/24
phantom-deps	phantom-dep:core-js-pure	AI (phantom-deps): core-js-pure is a declared runtime dep used as part of Storybook's polyfill strategy; phantom detection is a false positive for this package.	ai	2026/04/23
phantom-deps	phantom-dep:@types/markdown-to-jsx	AI (phantom-deps): Type definitions declared as runtime dep for framework convention loading; false positive for this package.	ai	2026/04/23
phantom-deps	phantom-dep:@storybook/channels	AI (phantom-deps): Same-org Storybook package declared as a runtime dep; phantom detection is a false positive for this monorepo package.	ai	2026/04/23
phantom-deps	phantom-dep:@emotion/core	AI (phantom-deps): @emotion/core is a declared dep referenced in config/build files; standard for Storybook's theming/emotion setup.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Package predates Sigstore provenance support; trusted publisher with strong track record. Not a risk signal for this package.	ai	2026/04/23

Versions (showing 51 of 244)

View all versions

Version	Deps	Published
6.5.16	14 / 18	2023-01-26
6.5.15	14 / 18	2022-12-20
6.5.14	14 / 18	2022-12-02
6.5.13	14 / 18	2022-10-24
6.5.12	14 / 18	2022-09-14
6.5.11	14 / 18	2022-09-13
6.5.10	14 / 18	2022-08-03
6.5.9	14 / 18	2022-06-13
6.5.8	12 / 20	2022-06-08
6.5.7	12 / 20	2022-06-06
6.5.6	12 / 20	2022-05-30
6.5.5	12 / 20	2022-05-24
6.5.4	12 / 20	2022-05-23
6.5.3	12 / 20	2022-05-19
6.5.2	12 / 20	2022-05-19
6.5.0	12 / 20	2022-05-18
6.4.22	28 / 8	2022-04-14
6.4.21	28 / 8	2022-04-09
6.4.20	28 / 8	2022-04-01
6.4.19	28 / 8	2022-02-12
6.4.18	28 / 8	2022-02-02
6.4.17	28 / 8	2022-01-31
6.4.16	28 / 8	2022-01-29
6.4.15	28 / 8	2022-01-28
6.4.14	28 / 8	2022-01-21
6.4.13	28 / 8	2022-01-15
6.4.12	28 / 8	2022-01-11
6.4.10	28 / 8	2022-01-10
6.4.9	28 / 8	2021-12-09
6.4.8	28 / 8	2021-12-06
6.4.7	28 / 8	2021-12-03
6.4.5	28 / 8	2021-12-03
6.4.4	28 / 8	2021-12-01
6.4.3	28 / 8	2021-12-01
6.4.2	28 / 8	2021-12-01
6.4.1	28 / 8	2021-11-30
6.4.0	28 / 8	2021-11-26
6.3.13	29 / 8	2022-01-10
6.3.12	29 / 8	2021-10-14
6.3.11	29 / 8	2021-10-12
6.3.10	29 / 8	2021-10-06
6.3.9	29 / 8	2021-10-01
6.3.8	29 / 8	2021-09-03
6.3.7	29 / 8	2021-08-09
6.3.6	29 / 8	2021-07-26
6.3.5	29 / 8	2021-07-22
6.3.4	29 / 8	2021-07-08
6.3.3	29 / 8	2021-07-07
6.3.2	29 / 8	2021-06-30
6.3.1	29 / 8	2021-06-28
6.3.0	29 / 8	2021-06-23

v6.5.16

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.15

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.14

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.22

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.21

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.20

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.19

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.18

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.17

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.16

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.15

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.14

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.