babel-preset-react-native
Babel preset for React Native applications
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change ide→rafeca occurred in 2017; rafeca has 209 approved packages and long track record. Legitimate maintainer transition for the official React Native babel preset. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): rafeca is a long-standing npm publisher (5309 days) with 209 approved packages. Addition is consistent with legitimate React Native team maintainer transition in 2017. | ai | |
| phantom-deps | phantom-dep:babel-template | AI (phantom-deps): Babel presets reference plugins via string config, not direct require(); phantom dep detection is a false positive for this package type. | ai | |
| phantom-deps | phantom-dep:react-transform-hmr | AI (phantom-deps): Referenced in Babel config as a transform string, not directly imported; expected pattern for Babel presets. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require with 'babel-plugin-' prefix is the canonical Babel preset plugin-loading pattern; constrained to the babel-plugin namespace and not a security risk for this package. | ai | |
| phantom-deps | phantom-dep:babel-plugin-syntax-flow | AI (phantom-deps): Babel plugin referenced via config string, not direct require(); standard Babel preset pattern. | ai | |
| phantom-deps | phantom-dep:babel-plugin-transform-exponentiation-operator | AI (phantom-deps): Babel plugin referenced via config string, not direct require(); standard Babel preset pattern. | ai | |
| phantom-deps | phantom-dep:babel-plugin-syntax-jsx | AI (phantom-deps): Babel plugin referenced via config string, not direct require(); standard Babel preset pattern. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Flagged maintainers fb, mjesun, jeanlauliac are legitimate Facebook/Meta engineers maintaining official React Native tooling; not spam. | ai |
Versions (showing 36 of 36)
| Version | Deps | Published |
|---|---|---|
| 5.0.2 | 27 / 0 | |
| 5.0.1 | 27 / 0 | |
| 5.0.0 | 26 / 0 | |
| 4.0.1 | 32 / 0 | |
| 4.0.0 | 31 / 0 | |
| 3.0.2 | 31 / 0 | |
| 3.0.1 | 31 / 0 | |
| 3.0.0 | 31 / 0 | |
| 2.1.0 | 29 / 0 | |
| 2.0.1 | 29 / 0 | |
| 2.0.0 | 29 / 0 | |
| 1.9.2 | 29 / 0 | |
| 1.9.1 | 29 / 0 | |
| 1.9.0 | 29 / 0 | |
| 1.8.0 | 28 / 0 | |
| 1.7.0 | 27 / 0 | |
| 1.6.0 | 27 / 0 | |
| 1.5.7 | 27 / 0 | |
| 1.5.6 | 26 / 0 | |
| 1.5.5 | 26 / 0 | |
| 1.5.3 | 26 / 0 | |
| 1.5.2 | 26 / 0 | |
| 1.5.1 | 26 / 0 | |
| 1.5.0 | 26 / 0 | |
| 1.4.0 | 26 / 0 | |
| 1.3.0 | 26 / 0 | |
| 1.2.4 | 26 / 0 | |
| 1.2.2 | 26 / 0 | |
| 1.2.1 | 26 / 0 | |
| 1.2.0 | 26 / 0 | |
| 1.1.0 | 26 / 0 | |
| 1.0.0 | 22 / 0 | |
| 0.3.0 | 22 / 0 | |
| 0.2.1 | 3 / 0 | |
| 0.2.0 | 3 / 0 | |
| 0.1.0 | 24 / 0 |
v5.0.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-06-15. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-05-19. This could indicate a legitimate maintainer transition or an account compromise.
v5.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
2 findingsThis version was published by a different npm account than previous versions on 2017-09-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2017-08-22. This could indicate a legitimate maintainer transition or an account compromise.
v3.0.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2017-08-16. This could indicate a legitimate maintainer transition or an account compromise.