mobx — Greenflagged

Simple, scalable state management.

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

fredycmweststratecapajjillesandykogxaviergonz

Keywords

mobxmobservableobservablereact-componentreactreactjsreactivemodelfrpfunctional-reactive-programmingstate managementdata flow

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:dist/mobx.esm.development.js	AI (source-diff): Standard MobX build artifact; false positive on error-message table and debugger helper.	ai	2026/05/18
provenance	publisher-changed	AI (provenance): Transition from personal account to GitHub Actions CI/CD; confirmed by SLSA provenance.	ai	2026/05/04
publish-pattern	dormant-publish	AI (publish-pattern): Mature package with infrequent releases; 220-day gap is normal for stable libraries.	ai	2026/05/04
install-scripts	install-script:postinstall	AI (install-scripts): Postinstall runs `yarn --cwd website install` but `website` dir is not in published files. Dev-workflow leftover, no-op for consumers.	ai	2026/04/24
provenance	no-provenance	AI (provenance): MobX is a long-established, high-trust package published well before Sigstore provenance was widely adopted on npm. Absence of provenance is not a risk signal here.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): MobX uses new Function() to construct named debugger helper functions for improved dev-mode stack traces — a documented, intentional pattern in this package, not a security risk.	ai	2026/04/24

Versions (showing 51 of 206)

View all versions

Version	Deps	Published
6.15.4	0 / 9	2026-05-24
6.15.3	0 / 9	2026-05-07
6.15.2	0 / 9	2026-05-06
6.15.1	0 / 9	2026-05-04
6.15.0	0 / 9	2025-09-26
6.13.7	0 / 9	2025-03-17
6.13.6	0 / 9	2025-01-30
6.13.5	0 / 9	2024-10-16
6.13.4	0 / 9	2024-10-15
6.13.3	0 / 9	2024-09-26
6.13.2	0 / 9	2024-09-07
6.13.1	0 / 9	2024-07-18
6.13.0	0 / 9	2024-07-02
6.12.5	0 / 9	2024-06-30
6.12.4	0 / 9	2024-06-13
6.12.3	0 / 9	2024-03-28
6.12.1	0 / 9	2024-03-22
6.12.0	0 / 9	2023-11-27
6.11.0	0 / 9	2023-11-11
6.10.2	0 / 9	2023-08-31
6.10.1	0 / 9	2023-08-29
6.10.0	0 / 9	2023-07-18
6.9.1	0 / 9	2023-07-12
6.9.0	0 / 9	2023-03-25
6.8.0	0 / 9	2023-02-09
6.7.0	0 / 9	2022-11-14
6.6.2	0 / 9	2022-09-07
6.6.1	0 / 9	2022-06-27
6.6.0	0 / 9	2022-05-23
6.5.0	0 / 9	2022-03-17
6.4.2	0 / 9	2022-02-25
6.4.1	0 / 9	2022-02-19
6.4.0	0 / 9	2022-02-17
6.3.13	0 / 9	2022-01-21
6.3.12	0 / 9	2022-01-05
6.3.11	0 / 9	2022-01-05
6.3.10	0 / 9	2021-12-22
6.3.9	0 / 9	2021-12-15
6.3.8	0 / 9	2021-11-27
6.3.7	0 / 9	2021-11-11
6.3.6	0 / 9	2021-11-01
6.3.5	0 / 9	2021-10-14
6.3.4	0 / 9	2021-10-11
6.3.3	0 / 9	2021-08-31
6.3.2	0 / 9	2021-05-22
6.3.1	0 / 9	2021-05-18
6.3.0	0 / 9	2021-04-23
6.2.0	0 / 9	2021-04-10
6.1.8	0 / 9	2021-03-01
6.1.7	0 / 9	2021-02-17
6.1.6	0 / 9	2021-02-11

v6.15.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.15.3

2 findings

HIGH New file with network + code execution: dist/mobx.esm.development.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.15.2

2 findings

HIGH New file with network + code execution: dist/mobx.esm.development.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.15.1

2 findings

HIGH Publisher changed: mweststrate → GitHub Actions (on 2026-05-04) provenance

This version was published by a different npm account than previous versions on 2026-05-04. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.15.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.12.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.11.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.10.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.10.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.10.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.9.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.6.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.6.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.