← Home

rc-tabs

npm Repository Homepage

tabs ui component for react

100
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

benjycuiyesmeckafc163paranoidjkzombiejpicodothmadccc

Keywords

reactreact-componentreact-tabs

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/umi.3bf3bfb4.js AI (source-diff): This is a standard dumi/UMI documentation site webpack bundle. Minification is expected; no malicious content present. ai
source-diff obfuscated-file:dist/docs__index.md.5a678285.async.js AI (source-diff): Standard webpack async chunk containing rc-tabs documentation markdown rendered as React. No malicious content. ai
source-diff obfuscated-file:dist/demos.11f92399.async.js AI (source-diff): Standard webpack async chunk containing rc-tabs demo components for documentation site. No malicious content. ai
source-diff obfuscated-file:dist/76.77709ec5.async.js AI (source-diff): Standard webpack async chunk from dumi documentation build. Contains Redux and invariant utilities, no malicious content. ai
source-diff obfuscated-file:dist/548.62d105c5.async.js AI (source-diff): Standard webpack async chunk from dumi documentation build. Contains React component API table code, no malicious content. ai
source-diff obfuscated-file:dist/242.7c148438.async.js AI (source-diff): Standard webpack async chunk from dumi documentation build. Minified React/SVG component code, no malicious content. ai
source-diff net-exec-file:dist/umi.3bf3bfb4.js AI (source-diff): Network+exec pattern is triggered by normal browser-side webpack module loading in the dumi documentation bundle, not dropper/loader malware. ai
dependencies unvetted-dep:react-hammerjs AI (dependencies): react-hammerjs is a legitimate React wrapper for Hammer.js touch gestures; appropriate dependency for a tabs UI component with swipe support. ai
dependencies unvetted-dep:create-react-context AI (dependencies): create-react-context is a well-known React Context API polyfill used by many major libraries; its use here is legitimate for supporting older React versions. ai
dependencies unvetted-dep:rc-hammerjs AI (dependencies): rc-hammerjs is part of the rc-* ecosystem and pinned to ~0.6.0; stable dependency for this package. ai
source-diff net-exec-file:dist/rc-tabs.js AI (source-diff): Webpack UMD bundle is a legitimate build artifact for React component distribution; webpack's module system is not malicious code. ai
source-diff net-exec-file:dist/rc-tabs.min.js AI (source-diff): Minified webpack bundle is expected for production distribution; no malicious payload detected in sample. ai
dependencies unvetted-dep:rc-css-transition-group AI (dependencies): rc-css-transition-group is a react-component ecosystem package consistent with rc-tabs' purpose; same maintainer lineage, no malicious signals. ai
dependencies unvetted-dep:browserify-shim AI (dependencies): Build-time browserify transform; not a runtime dependency affecting end users. ai
dependencies unvetted-dep:browserify-jsx AI (dependencies): Build-time browserify transform; not a runtime dependency affecting end users. ai
provenance publisher-changed AI (provenance): Publisher change in 2018 reflects legitimate maintainer transition; stable for 6+ years. ai
source-diff source-size-tripled AI (source-diff): Size increase reflects addition of dist/ bundles (normal for component library releases), not injected payload. ai
publish-pattern new-deps-added AI (publish-pattern): lodash is an established, widely-trusted utility library; legitimate addition for a mature component library. ai
maintainer-change maintainer-removed AI (maintainer-change): dxq613 removal is consistent with Ant Design org restructuring; new team is established and trusted. ai
maintainer-change maintainer-added AI (maintainer-change): Maintainer transition occurred in 2018 and is well-established; no compromise indicators. ai
source-diff large-new-source-files AI (source-diff): 27 new files consistent with component library expansion; no obfuscation or malicious patterns detected. ai
maintainer-change maintainer-takeover AI (maintainer-change): Complete maintainer transition in 2017 on established package; 7+ years of stable history post-transition validates legitimacy. ai
phantom-deps phantom-dep:browserify-jsx AI (phantom-deps): browserify-jsx is used as a browserify transform configured in package.json's browserify.transform field, not imported directly in JS. This is the correct usage pattern for browserify transforms. ai
phantom-deps phantom-dep:browserify-shim AI (phantom-deps): browserify-shim is used as a browserify transform/shim configured in package.json, not imported directly. This is the correct usage pattern for browserify-shim. ai
semgrep semgrep:child-process-import AI (semgrep): child_process used in gulpfile.js for build tasks (linting, git tagging); standard development tooling, not in published code. ai
semgrep semgrep:child-process-exec AI (semgrep): exec() in gulpfile.js for git tagging during publish; standard build workflow, not in distributed package. ai
dependencies unvetted-dep:rc-menu AI (dependencies): rc-menu is a well-known react-component ecosystem package; stable dependency for rc-tabs across all versions. ai
provenance no-provenance AI (provenance): Provenance attestation is not yet standard practice in npm ecosystem; absence is not a security concern for this established package. ai
dependencies unvetted-dep:rc-resize-observer AI (dependencies): rc-resize-observer is a standard utility in the react-component ecosystem; stable dependency for rc-tabs. ai
dependencies unvetted-dep:rc-dropdown AI (dependencies): rc-dropdown is a well-known react-component ecosystem package; stable dependency for rc-tabs. ai
dependencies unvetted-dep:rc-motion AI (dependencies): rc-motion is a standard animation package in the react-component ecosystem; stable dependency for rc-tabs. ai
dependencies unvetted-dep:rc-util AI (dependencies): rc-util is a core utility package in the react-component/Ant Design ecosystem; stable dependency for rc-tabs. ai

Versions (showing 100 of 223)

Version Deps Published
15.7.0 7 / 37
15.6.1 7 / 37
15.6.0 7 / 37
15.5.2 7 / 34
15.5.1 7 / 34
15.5.0 7 / 34
15.4.0 7 / 33
15.3.0 7 / 33
15.2.0 7 / 33
15.1.1 7 / 33
15.1.0 7 / 33
15.0.0 7 / 33
14.1.1 7 / 33
14.1.0 7 / 33
14.0.0 7 / 33
13.0.0 7 / 33
12.15.0 7 / 33
12.14.1 7 / 33
12.14.0 7 / 31
12.13.1 7 / 31
12.13.0 7 / 31
12.12.1 7 / 31
12.12.0 7 / 31
12.11.1 7 / 31
12.11.0 7 / 31
12.10.0 7 / 31
12.9.0 7 / 31
12.8.1 7 / 31
12.8.0 7 / 31
12.7.1 7 / 31
12.7.0 7 / 31
12.6.0 7 / 31
12.5.10 7 / 30
12.5.9 7 / 30
12.5.8 7 / 30
12.5.7 7 / 30
12.5.6 7 / 30
12.5.5 7 / 30
12.5.3 7 / 30
12.5.1 7 / 30
12.5.0 7 / 30
12.4.2 7 / 33
12.4.1 7 / 33
12.3.0 7 / 33
12.2.2 7 / 33
12.2.1 7 / 32
11.16.1 6 / 31
11.16.0 6 / 31
11.15.0 6 / 31
11.14.2 6 / 31
11.14.1 6 / 31
11.14.0 6 / 31
11.13.0 6 / 31
11.12.0 6 / 31
11.11.1 6 / 31
11.11.0 6 / 31
11.10.8 6 / 31
11.10.7 6 / 31
11.10.5 6 / 31
11.10.4 6 / 31
11.10.3 6 / 31
11.10.2 6 / 31
11.10.1 6 / 31
11.10.0 6 / 31
11.9.1 6 / 31
11.9.0 6 / 31
11.8.0 6 / 31
11.7.3 6 / 29
11.7.2 6 / 29
11.7.1 7 / 30
11.7.0 7 / 30
11.6.2 7 / 30
11.6.1 8 / 30
11.6.0 8 / 30
11.5.7 8 / 31
11.5.6 8 / 31
11.5.5 8 / 31
11.5.4 8 / 31
11.5.3 8 / 31
11.5.2 8 / 31
11.5.1 8 / 31
11.5.0 8 / 31
11.4.1 8 / 31
11.4.0 8 / 31
11.3.2 8 / 31
11.3.1 8 / 31
11.3.0 8 / 31
11.2.4 8 / 31
11.2.3 8 / 31
11.2.2 8 / 31
11.2.1 8 / 31
11.2.0 8 / 31
11.1.1 8 / 31
11.1.0 8 / 31
11.0.4 8 / 31
11.0.3 7 / 31
11.0.2 7 / 31
11.0.1 7 / 31
11.0.0 7 / 31
10.1.1 5 / 23
Showing 100 of 223 Next page →

v15.7.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2025-07-23) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-07-23. This could indicate a legitimate maintainer transition or an account compromise.

v15.6.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v15.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v15.5.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v15.5.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2025-02-07) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-02-07. This could indicate a legitimate maintainer transition or an account compromise.

v15.5.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2024-12-17) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-12-17. This could indicate a legitimate maintainer transition or an account compromise.

v15.4.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2024-10-30) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-10-30. This could indicate a legitimate maintainer transition or an account compromise.

v15.3.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → afc163 (on 2024-09-29) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-09-29. This could indicate a legitimate maintainer transition or an account compromise.

v15.2.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2024-08-16) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-08-16. This could indicate a legitimate maintainer transition or an account compromise.

v15.1.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v15.1.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2024-05-17) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-05-17. This could indicate a legitimate maintainer transition or an account compromise.

v15.0.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v14.1.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2024-03-08) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-08. This could indicate a legitimate maintainer transition or an account compromise.

v14.1.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2024-03-08) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-03-08. This could indicate a legitimate maintainer transition or an account compromise.

v14.0.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → afc163 (on 2024-01-04) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-01-04. This could indicate a legitimate maintainer transition or an account compromise.

v13.0.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → afc163 (on 2024-01-04) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2024-01-04. This could indicate a legitimate maintainer transition or an account compromise.

v12.15.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.14.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-11-28) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-28. This could indicate a legitimate maintainer transition or an account compromise.

v12.14.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-11-27) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-11-27. This could indicate a legitimate maintainer transition or an account compromise.

v12.13.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.13.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.12.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2023-09-06) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-09-06. This could indicate a legitimate maintainer transition or an account compromise.

v12.12.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.11.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.11.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → madccc (on 2023-08-24) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-08-24. This could indicate a legitimate maintainer transition or an account compromise.

v12.10.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.9.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2023-06-25) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-06-25. This could indicate a legitimate maintainer transition or an account compromise.

v12.8.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.8.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.7.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: yiminghe → zombiej (on 2023-05-24) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-05-24. This could indicate a legitimate maintainer transition or an account compromise.

v12.7.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-05-23) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-05-23. This could indicate a legitimate maintainer transition or an account compromise.

v12.6.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-04-27) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-04-27. This could indicate a legitimate maintainer transition or an account compromise.

v12.5.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.5.9

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-03-09) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-09. This could indicate a legitimate maintainer transition or an account compromise.

v12.5.8

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-03-09) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-03-09. This could indicate a legitimate maintainer transition or an account compromise.

v12.5.7

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2023-02-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-02-21. This could indicate a legitimate maintainer transition or an account compromise.

v12.5.6

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2023-01-05) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2023-01-05. This could indicate a legitimate maintainer transition or an account compromise.

v12.5.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.5.3

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2022-12-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-12-21. This could indicate a legitimate maintainer transition or an account compromise.

v12.5.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.5.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2022-12-19) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-12-19. This could indicate a legitimate maintainer transition or an account compromise.

v12.4.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.4.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2022-11-22) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-11-22. This could indicate a legitimate maintainer transition or an account compromise.

v12.3.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v12.2.2

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → afc163 (on 2022-11-02) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-11-02. This could indicate a legitimate maintainer transition or an account compromise.

v12.2.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2022-10-11) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-10-11. This could indicate a legitimate maintainer transition or an account compromise.

v11.16.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.16.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.15.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.14.2

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2022-05-26) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-05-26. This could indicate a legitimate maintainer transition or an account compromise.

v11.14.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.14.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2022-04-28) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-04-28. This could indicate a legitimate maintainer transition or an account compromise.

v11.13.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: madccc → zombiej (on 2022-04-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-04-21. This could indicate a legitimate maintainer transition or an account compromise.

v11.12.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2022-03-28) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-03-28. This could indicate a legitimate maintainer transition or an account compromise.

v11.11.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.11.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.10.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.10.7

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → madccc (on 2022-03-02) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2022-03-02. This could indicate a legitimate maintainer transition or an account compromise.

v11.10.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.10.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.10.3

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2021-11-11) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-11-11. This could indicate a legitimate maintainer transition or an account compromise.

v11.10.2

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2021-10-21) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-10-21. This could indicate a legitimate maintainer transition or an account compromise.

v11.10.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2021-07-29) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-07-29. This could indicate a legitimate maintainer transition or an account compromise.

v11.10.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.9.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2021-05-24) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2021-05-24. This could indicate a legitimate maintainer transition or an account compromise.

v11.9.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.8.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.7.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.7.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.7.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2020-11-16) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-11-16. This could indicate a legitimate maintainer transition or an account compromise.

v11.7.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2020-10-14) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-10-14. This could indicate a legitimate maintainer transition or an account compromise.

v11.6.2

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2020-09-15) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-09-15. This could indicate a legitimate maintainer transition or an account compromise.

v11.6.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.6.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2020-08-04) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-08-04. This could indicate a legitimate maintainer transition or an account compromise.

v11.5.7

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2020-08-18) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-08-18. This could indicate a legitimate maintainer transition or an account compromise.

v11.5.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.5.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.5.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.5.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.5.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.5.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.5.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.4.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.4.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.3.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.3.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.3.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.2.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.2.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.1.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v11.0.0

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: afc163 → zombiej (on 2020-05-28) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-05-28. This could indicate a legitimate maintainer transition or an account compromise.

v10.1.1

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zombiej → afc163 (on 2020-03-18) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2020-03-18. This could indicate a legitimate maintainer transition or an account compromise.