← Home

gatsby-interface

npm

Component library for Gatsby projects

51
Versions
ISC
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

smcgaritykathmbecknodebotanistj0sh77mcolelittletyhoppkgarbayamarvinjudehkkylemathewsdschaupiehwardpeettylerbarnesfksmthomaslekoartsdmccrawabhiaiyerjulienprachelbahldaniellewgatsbymlgualtieri-gatsbygatsby_integrationsgreglobinski

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher change from elanhant to greglobinski occurred in 2021 as part of a legitimate Gatsby team transition; new maintainer list includes known Gatsby core team members. Stable for this package. ai
maintainer-change maintainer-removed AI (maintainer-change): Removed maintainers are former Gatsby team members; consistent with org team changes, not a hostile takeover. ai
bogus-package bogus-package AI (bogus-package): pieh's mass package ownership reflects Gatsby's plugin ecosystem. No repo link is a minor gap for a well-known 2500+ day old package with 800+ versions. ai
maintainer-change maintainer-added AI (maintainer-change): Gatsby org team rotation; new maintainers are known Gatsby contributors. Normal for a long-lived org-owned package. ai
phantom-deps phantom-dep:@loadable/component AI (phantom-deps): Component library pattern; @loadable/component is a legitimate dependency for re-export or consumer configuration. ai
phantom-deps phantom-dep:gatsby-design-tokens AI (phantom-deps): Component library pattern; gatsby-design-tokens is a legitimate dependency for re-export or consumer configuration. ai
phantom-deps phantom-dep:@types/lodash.sample AI (phantom-deps): @types/lodash.sample is a legitimate dev dependency declared in package.json for TypeScript support; not a phantom dependency. ai
phantom-deps phantom-dep:case AI (phantom-deps): case is a legitimate dependency declared in package.json and used by the component library; not a phantom dependency. ai
phantom-deps phantom-dep:theme-ui AI (phantom-deps): theme-ui is a legitimate dependency declared in package.json and used by the component library; not a phantom dependency. ai
phantom-deps phantom-dep:@reach/alert AI (phantom-deps): @reach/alert is a legitimate dependency declared in package.json and used by the component library; not a phantom dependency. ai
phantom-deps phantom-dep:@mdx-js/react AI (phantom-deps): @mdx-js/react is a legitimate dependency declared in package.json and used by the component library; not a phantom dependency. ai
phantom-deps phantom-dep:lodash.sample AI (phantom-deps): lodash.sample is a legitimate dependency declared in package.json and used by the component library; not a phantom dependency. ai

Versions (showing 51 of 290)

View all versions
Version Deps Published
0.0.295 17 / 102
0.0.294 17 / 102
0.0.293 17 / 102
0.0.292 17 / 102
0.0.291 17 / 102
0.0.290 17 / 102
0.0.289 17 / 102
0.0.287 17 / 102
0.0.286 17 / 102
0.0.285 17 / 102
0.0.284 17 / 102
0.0.283 17 / 102
0.0.282 17 / 102
0.0.281 17 / 102
0.0.280 17 / 102
0.0.279 17 / 102
0.0.278 17 / 102
0.0.277 17 / 102
0.0.276 17 / 102
0.0.275 17 / 102
0.0.274 17 / 102
0.0.273 17 / 102
0.0.272 17 / 102
0.0.271 17 / 102
0.0.270 17 / 102
0.0.269 17 / 102
0.0.267 17 / 102
0.0.266 17 / 102
0.0.265 17 / 102
0.0.264 17 / 102
0.0.263 17 / 102
0.0.262 17 / 102
0.0.261 17 / 102
0.0.260 17 / 102
0.0.259 17 / 102
0.0.258 17 / 102
0.0.257 17 / 102
0.0.256 17 / 102
0.0.255 17 / 102
0.0.254 17 / 102
0.0.253 17 / 102
0.0.252 17 / 102
0.0.251 17 / 102
0.0.250 17 / 102
0.0.249 17 / 102
0.0.248 17 / 102
0.0.247 17 / 102
0.0.246 17 / 102
0.0.245 17 / 102
0.0.244 17 / 102
0.0.243 17 / 102

v0.0.295

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.294

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.293

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.292

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.291

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.290

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.289

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.287

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.286

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.285

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.284

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.283

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.282

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.281

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.280

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.279

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.278

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.277

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.276

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.275

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.274

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.273

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.272

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.271

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.270

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.269

2 findings
HIGH Publisher changed: elanhant → greglobinski (on 2021-06-16) provenance

This version was published by a different npm account than previous versions on 2021-06-16. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.267

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.266

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.265

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.264

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.263

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.262

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.261

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.260

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.259

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.258

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.257

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.256

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.255

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.254

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.253

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.252

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.251

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.250

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.249

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.248

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.247

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.246

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.245

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.244

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.243

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.