rc-form-validation — Greenflagged

form-validation ui component for react

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

yiminghe

Keywords

reactreact-componentreact-form-validationform-validation

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:browserify-jsx	AI (dependencies): browserify-jsx is a Browserify JSX transform used as a build tool for this era React component; not a runtime security risk for this package.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Package is 4100+ days old; Sigstore provenance predates its publication. No provenance is expected and stable for all versions of this package.	ai	2026/04/24
phantom-deps	phantom-dep:browserify-jsx	AI (phantom-deps): browserify-jsx is used as a Browserify transform declared in the browserify config block, not via direct import. This is a legitimate usage pattern for Browserify transforms.	ai	2026/04/24
phantom-deps	phantom-dep:browserify-shim	AI (phantom-deps): browserify-shim is used as a Browserify transform/shim declared in the browserify config block, not via direct import. This is a legitimate usage pattern for Browserify transforms.	ai	2026/04/24
dependencies	unvetted-dep:rc-util	AI (dependencies): rc-util is a well-known utility library from the same react-component ecosystem; its use here is expected and stable across versions of this package.	ai	2026/04/21

Versions (showing 35 of 35)

Version	Deps	Published
2.4.16	3 / 11	2015-11-16
2.4.15	3 / 11	2015-11-16
2.4.14	3 / 11	2015-11-03
2.4.13	3 / 9	2015-10-11
2.4.12	3 / 9	2015-09-01
2.4.11	3 / 9	2015-08-28
2.4.10	3 / 9	2015-08-28
2.4.9	3 / 9	2015-08-27
2.4.8	3 / 9	2015-08-27
2.4.7	3 / 9	2015-07-17
2.4.6	3 / 9	2015-07-02
2.4.5	3 / 9	2015-06-17
2.4.4	3 / 9	2015-06-17
2.4.3	3 / 9	2015-06-15
2.4.2	3 / 9	2015-06-15
2.4.1	3 / 9	2015-06-10
2.4.0	3 / 9	2015-06-10
2.3.2	2 / 10	2015-06-09
2.3.1	2 / 10	2015-05-28
2.3.0	2 / 10	2015-05-25
2.2.0	2 / 10	2015-04-30
2.1.1	2 / 10	2015-03-19
2.1.0	2 / 10	2015-03-19
2.0.0	2 / 16	2015-03-17
1.0.1	2 / 14	2015-03-12
1.0.0	2 / 14	2015-03-10
0.5.0	2 / 14	2015-03-10
0.4.2	3 / 14	2015-02-14
0.4.1	3 / 7	2015-02-11
0.4.0	2 / 7	2015-02-10
0.3.1	2 / 7	2015-02-09
0.3.0	2 / 7	2015-02-09
0.2.1	2 / 7	2015-02-02
0.2.0	2 / 6	2015-01-27
0.1.0	3 / 6	2015-01-26

v2.4.16

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.15

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.14

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.