d3
Data-Driven Documents
14
Versions
ISC
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
mbostockrecifs
Keywords
d3domvisualizationsvganimationcanvas
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): recifs (Philippe Rivière) is a known long-time D3 collaborator; publisher transition is legitimate for this package. | ai | |
| provenance | missing-githead | AI (provenance): Published in 2020 before provenance tooling was standard; consistent with D3's publish environment at the time. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): recifs is a trusted D3 project collaborator with extensive npm track record (1230 approved packages). | ai | |
| provenance | no-provenance | AI (provenance): D3 was published before Sigstore provenance existed; no provenance is expected for 2020-era releases. | ai | |
| source-diff | encoded-string-file:dist/d3.js | AI (source-diff): Long hex strings in d3 dist files are color palette data (viridis, magma, etc.) — a well-known, documented part of d3-scale-chromatic, not obfuscated payloads. | ai | |
| source-diff | encoded-string-file:dist/d3.min.js | AI (source-diff): Same color palette hex strings appear in the minified bundle; standard rollup output for d3's color scale implementation. | ai |