babel-plugin-transform-react-jsx-source
Add a __source prop to all JSX Elements
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate maintainer transition from sebmck (Babel creator) to hzoo (long-time Babel core maintainer). Well-documented project handoff. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Babel monorepo plugin; hzoo/sebmck/loganfsmyth are core Babel maintainers. Tiny payload and templated names are expected for Babel plugins. | ai | |
| phantom-deps | phantom-dep:babel-runtime | AI (phantom-deps): babel-runtime is resolved via Babel's plugin infrastructure, not direct import. | ai | |
| phantom-deps | phantom-dep:babel-plugin-syntax-jsx | AI (phantom-deps): babel-plugin-syntax-jsx is loaded via Babel's inherits mechanism, not direct import. | ai | |
| provenance | no-provenance | AI (provenance): Babel v6 predates Sigstore provenance; no provenance expected for legacy versions. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 6.22.0 | 2 / 1 | |
| 6.9.0 | 2 / 1 | |
| 6.8.0 | 2 / 1 | |
| 6.5.0 | 2 / 1 | |
| 6.3.13 | 2 / 1 | |
| 6.2.4 | 2 / 1 | |
| 6.1.18 | 2 / 1 | |
| 6.1.17 | 2 / 1 | |
| 6.1.4 | 2 / 1 |
v6.22.0
2 findingsMatched 3 signal(s), weighted score 7: • [S_KNOWN_SPAM_PUBLISHER] Maintainer(s) previously flagged as spam: sebmck, jmm, amasad, thejameskyle, hzoo, loganfsmyth. • [S_PUBLISHER_MASS_PRODUCTION] Maintainer 'loganfsmyth' owns 167 packages, ≥70% share a templated name shape. • [S_TINY_PAYLOAD] Tiny payload: 1 code file(s), 2834 bytes total.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.8.0
2 findingsThis version was published by a different npm account than previous versions on 2016-05-02. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.5.0
2 findingsThis version was published by a different npm account than previous versions on 2016-02-07. This could indicate a legitimate maintainer transition or an account compromise.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.3.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.2.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.