rc-calendar
React Calendar
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from afc163 to zombiej in Jan 2019 is a documented maintainer transition within the react-component org. zombiej is a prolific, established publisher in this ecosystem. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): react-lifecycles-compat is a React core team utility for React 16.3+ lifecycle compatibility. Its addition alongside removal of create-react-class is a standard migration pattern, not a supply chain risk. | ai |
Versions (showing 100 of 217)
| Version | Deps | Published |
|---|---|---|
| 9.15.11 | 7 / 18 | |
| 9.15.10 | 7 / 18 | |
| 9.15.9 | 7 / 18 | |
| 9.15.8 | 7 / 18 | |
| 9.15.7 | 7 / 18 | |
| 9.15.6 | 7 / 18 | |
| 9.15.5 | 7 / 18 | |
| 9.15.4 | 7 / 18 | |
| 9.15.3 | 7 / 18 | |
| 9.15.2 | 7 / 19 | |
| 9.15.1 | 7 / 19 | |
| 9.15.0 | 7 / 19 | |
| 9.14.5 | 7 / 19 | |
| 9.13.4 | 7 / 19 | |
| 9.13.3 | 7 / 19 | |
| 9.13.2 | 7 / 19 | |
| 9.13.1 | 7 / 19 | |
| 9.13.0 | 7 / 19 | |
| 9.12.4 | 7 / 19 | |
| 9.12.3 | 7 / 19 | |
| 9.12.1 | 7 / 19 | |
| 9.11.0 | 7 / 19 | |
| 9.10.10 | 7 / 19 | |
| 9.10.9 | 7 / 19 | |
| 9.10.8 | 7 / 19 | |
| 9.10.7 | 7 / 19 | |
| 9.10.6 | 7 / 19 | |
| 9.10.5 | 7 / 19 | |
| 9.10.4 | 7 / 19 | |
| 9.10.3 | 7 / 19 | |
| 9.10.2 | 7 / 19 | |
| 9.10.1 | 7 / 19 | |
| 9.10.0 | 7 / 19 | |
| 9.9.2 | 7 / 19 | |
| 9.9.1 | 7 / 19 | |
| 9.9.0 | 7 / 19 | |
| 9.8.2 | 7 / 19 | |
| 9.8.1 | 7 / 19 | |
| 9.8.0 | 7 / 19 | |
| 9.7.11 | 7 / 19 | |
| 9.7.10 | 7 / 19 | |
| 9.7.9 | 7 / 19 | |
| 9.7.8 | 7 / 19 | |
| 9.7.7 | 7 / 19 | |
| 9.7.6 | 7 / 19 | |
| 9.7.5 | 7 / 19 | |
| 9.7.4 | 7 / 19 | |
| 9.7.3 | 7 / 19 | |
| 9.7.2 | 7 / 19 | |
| 9.7.1 | 7 / 19 | |
| 9.7.0 | 7 / 19 | |
| 9.6.2 | 7 / 19 | |
| 9.6.1 | 7 / 19 | |
| 9.6.0 | 7 / 15 | |
| 9.5.0 | 7 / 15 | |
| 9.4.0 | 7 / 15 | |
| 9.3.2 | 7 / 15 | |
| 9.3.1 | 7 / 15 | |
| 9.3.0 | 7 / 15 | |
| 9.2.0 | 7 / 15 | |
| 9.1.12 | 7 / 15 | |
| 9.1.11 | 7 / 15 | |
| 9.1.10 | 7 / 15 | |
| 9.1.9 | 7 / 15 | |
| 9.1.8 | 7 / 15 | |
| 9.1.7 | 7 / 15 | |
| 9.1.6 | 7 / 15 | |
| 9.1.5 | 7 / 15 | |
| 9.1.4 | 7 / 15 | |
| 9.1.3 | 7 / 15 | |
| 9.1.2 | 7 / 15 | |
| 9.1.1 | 7 / 15 | |
| 9.1.0 | 7 / 15 | |
| 9.0.4 | 7 / 15 | |
| 9.0.3 | 7 / 15 | |
| 9.0.2 | 7 / 15 | |
| 9.0.1 | 7 / 15 | |
| 9.0.0 | 7 / 15 | |
| 8.4.7 | 7 / 17 | |
| 8.4.6 | 7 / 17 | |
| 8.4.5 | 7 / 17 | |
| 8.4.4 | 7 / 17 | |
| 8.4.3 | 7 / 17 | |
| 8.4.2 | 7 / 17 | |
| 8.4.1 | 7 / 17 | |
| 8.4.0 | 7 / 17 | |
| 8.3.3 | 7 / 17 | |
| 8.3.2 | 7 / 18 | |
| 8.3.1 | 7 / 18 | |
| 8.3.0 | 7 / 18 | |
| 8.2.0 | 7 / 18 | |
| 8.1.3 | 7 / 18 | |
| 8.1.2 | 7 / 19 | |
| 8.1.1 | 7 / 19 | |
| 8.1.0 | 5 / 18 | |
| 8.0.1 | 5 / 18 | |
| 8.0.0 | 5 / 18 | |
| 7.8.0 | 5 / 17 | |
| 7.7.1 | 5 / 15 | |
| 7.7.0 | 5 / 15 |
v9.15.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.5
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-07-31. This could indicate a legitimate maintainer transition or an account compromise.
v9.15.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-07-15. This could indicate a legitimate maintainer transition or an account compromise.
v9.15.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.2
2 findingsThis version was published by a different npm account than previous versions on 2019-06-27. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.15.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.14.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.13.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.13.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.13.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.13.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.13.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.12.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.12.3
2 findingsThis version was published by a different npm account than previous versions on 2019-04-01. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.12.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2019-03-30. This could indicate a legitimate maintainer transition or an account compromise.
v9.11.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.10.0
2 findingsThis version was published by a different npm account than previous versions on 2019-01-02. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.9.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.9.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.9.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-12-24. This could indicate a legitimate maintainer transition or an account compromise.
v9.8.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-12-17. This could indicate a legitimate maintainer transition or an account compromise.
v9.8.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-12-06. This could indicate a legitimate maintainer transition or an account compromise.
v9.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.10
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-10-09. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.9
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-30. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.7
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-08. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.6
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-07. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-03. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.7.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-02. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.1
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-02. This could indicate a legitimate maintainer transition or an account compromise.
v9.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.6.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v8.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.