@tellescope/chat
Shared UI components designed with support for React and React Native in mind. To be used across Tellescope web apps and open-sourced modules.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Part of tellescope monorepo; sparse README/keywords is consistent across all 814 versions, not spam. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): ESLint declared as runtime dep but used as dev tooling; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-react | AI (phantom-deps): ESLint plugin declared as runtime dep but used as dev tooling; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/parser | AI (phantom-deps): TS ESLint tooling declared as runtime dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/eslint-plugin | AI (phantom-deps): TS ESLint tooling declared as runtime dep; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:chalk | AI (typosquat): @tellescope/chat is a scoped React chat component, not a typosquat of chalk; name similarity is coincidental. | ai | |
| phantom-deps | phantom-dep:@emotion/react | AI (phantom-deps): MUI peer/config dependency; standard pattern for React component libraries. | ai | |
| phantom-deps | phantom-dep:@emotion/styled | AI (phantom-deps): MUI peer/config dependency; standard pattern for React component libraries. | ai | |
| phantom-deps | phantom-dep:@fontsource/roboto | AI (phantom-deps): Font dependency referenced in config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@mui/icons-material | AI (phantom-deps): MUI icons referenced in config; stable false positive for this React component library. | ai |
Versions (showing 6 of 107)
| Version | Deps | Published |
|---|---|---|
| 1.199.1 | 18 / 3 | |
| 1.199.0 | 18 / 3 | |
| 1.198.0 | 18 / 3 | |
| 1.197.0 | 18 / 3 | |
| 1.196.0 | 18 / 3 | |
| 1.195.0 | 18 / 3 |
v1.199.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.199.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.198.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.197.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.196.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.195.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.