babel-plugin-named-asset-import
Babel plugin for named asset imports in Create React App
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is a known monorepo stub pattern for CRA packages; this package has 43 versions and 8+ years of history. Not a malicious indicator here. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Minimal metadata is consistent with a monorepo stub version; package has 43 versions, strong publisher history, and 3 approved inbound edges. | ai | |
| provenance | publisher-changed | AI (provenance): timer → iansu is a documented, legitimate CRA maintainer transition; iansu is a known CRA lead with a clean track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): ianschmitz is a known CRA contributor; addition is consistent with the project's maintainer roster at this time. | ai | |
| provenance | no-provenance | AI (provenance): Package was published in 2019 before Sigstore provenance was available; absence is expected and not a risk signal. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.3.8 | 0 / 2 | |
| 0.3.7 | 0 / 2 | |
| 0.3.6 | 0 / 2 | |
| 0.3.5 | 0 / 2 | |
| 0.3.4 | 0 / 2 | |
| 0.3.3 | 0 / 2 | |
| 0.3.2 | 0 / 2 | |
| 0.3.1 | 0 / 2 | |
| 0.3.0 | 0 / 2 | |
| 0.2.3 | 0 / 2 | |
| 0.2.2 | 0 / 0 | |
| 0.2.1 | 0 / 0 | |
| 0.2.0 | 0 / 0 | |
| 0.0.0 | 0 / 0 |
v0.3.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.3
2 findingsThis version was published by a different npm account than previous versions on 2019-08-09. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.2
2 findingsThis version was published by a different npm account than previous versions on 2019-04-22. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
2 findingsThis version was published by a different npm account than previous versions on 2019-02-10. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.