eslint-plugin-jsx-a11y
Static AST checker for accessibility rules on JSX elements.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects legitimate addition of new ESLint accessibility rules in an early version of this well-established plugin; consistent with organic feature growth. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance by years; absence is expected for this vintage and not a security concern given strong publisher track record. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Early-stage ESLint plugin adding many rule files is expected growth, not injected code. Package has clean build pipeline with no install scripts or obfuscation. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): lencioni is a known OSS contributor and documented collaborator on this project; addition is consistent with legitimate team expansion. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): object-assign is a ubiquitous, well-vetted polyfill with no malicious history; benign addition for this package. | ai | |
| provenance | publisher-changed | AI (provenance): ljharb is a highly trusted npm publisher (1408 approved packages, 4617 days active). The transition from evcohen to ljharb in 2017 is a documented, legitimate maintainer handoff. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used in scripts/create-rule.js, a developer scaffolding script not executed at install or runtime. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is in test files only, used to load rule modules by name for ESLint plugin testing. Not a runtime risk. | ai | |
| phantom-deps | phantom-dep:ast-types-flow | AI (phantom-deps): ast-types-flow is a legitimate runtime dependency declared in package.json; phantom-dep flag is a false positive for this package. | ai |
Versions (showing 51 of 84)
| Version | Deps | Published |
|---|---|---|
| 6.10.2 | 15 / 28 | |
| 6.10.1 | 16 / 28 | |
| 6.10.0 | 16 / 29 | |
| 6.9.0 | 16 / 31 | |
| 6.8.0 | 16 / 30 | |
| 6.7.1 | 16 / 29 | |
| 6.7.0 | 16 / 29 | |
| 6.6.1 | 13 / 28 | |
| 6.6.0 | 13 / 28 | |
| 6.5.1 | 12 / 24 | |
| 6.5.0 | 12 / 23 | |
| 6.4.1 | 11 / 22 | |
| 6.4.0 | 11 / 22 | |
| 6.3.1 | 11 / 22 | |
| 6.3.0 | 11 / 22 | |
| 6.2.3 | 9 / 22 | |
| 6.2.2 | 8 / 23 | |
| 6.2.1 | 8 / 25 | |
| 6.2.0 | 8 / 25 | |
| 6.1.2 | 8 / 25 | |
| 6.1.1 | 8 / 24 | |
| 6.1.0 | 8 / 24 | |
| 6.0.3 | 7 / 24 | |
| 6.0.2 | 7 / 22 | |
| 6.0.1 | 7 / 22 | |
| 6.0.0 | 7 / 22 | |
| 5.1.1 | 7 / 22 | |
| 5.1.0 | 7 / 20 | |
| 5.0.3 | 7 / 20 | |
| 5.0.2 | 7 / 20 | |
| 5.0.1 | 7 / 20 | |
| 5.0.0 | 6 / 20 | |
| 4.0.0 | 6 / 20 | |
| 3.0.2 | 3 / 12 | |
| 3.0.1 | 3 / 12 | |
| 2.2.3 | 3 / 11 | |
| 2.2.2 | 3 / 11 | |
| 2.2.1 | 3 / 11 | |
| 2.2.0 | 3 / 11 | |
| 2.1.0 | 3 / 11 | |
| 2.0.1 | 3 / 11 | |
| 2.0.0 | 3 / 11 | |
| 1.5.5 | 3 / 11 | |
| 1.5.4 | 3 / 11 | |
| 1.5.3 | 3 / 11 | |
| 1.5.2 | 3 / 11 | |
| 1.5.1 | 3 / 11 | |
| 1.5.0 | 3 / 11 | |
| 1.4.2 | 3 / 11 | |
| 1.4.1 | 3 / 11 | |
| 1.4.0 | 3 / 9 |
v6.10.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.10.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.5.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.1
2 findingsThis version was published by a different npm account than previous versions on 2017-07-04. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.