react-spinners — Greenflagged

A collection of react loading spinners

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

davidhu2000

Keywords

react-spinnersreactloaderspinnerhalogen

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:docs/js/vendors~main-08b1ce5f6b71494cdf3b.js	AI (source-diff): Webpack vendor bundle for demo site; network+exec pattern is from bundled React/browser APIs, not dropper malware.	ai	2026/04/24
source-diff	obfuscated-file:docs/js/main-08b1ce5f6b71494cdf3b.js	AI (source-diff): Webpack-bundled demo site asset in docs/ directory; standard webpack bootstrap boilerplate, not malicious obfuscation.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): Size increase entirely due to webpack demo build output and source maps in docs/; not a payload injection.	ai	2026/04/24
source-diff	large-new-source-files	AI (source-diff): Large file count is from webpack demo build artifacts in docs/; not injected payload.	ai	2026/04/24
source-diff	obfuscated-file:docs/main-fab79780f85857889681.js	AI (source-diff): This is a webpack-bundled demo/docs file, not runtime library code. The package main is dist/index.js. Minified docs assets are expected for this package.	ai	2026/04/24
source-diff	net-exec-file:docs/vendors~main-fab79780f85857889681.js	AI (source-diff): False positive: the 'network+exec' pattern is webpack's webpackJsonp loader and emotion's CSS injection into DOM — standard bundled docs output, not dropper malware.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() is in the emotion CSS-in-JS vendor bundle in docs/. This is a well-known pattern in CSS-in-JS libraries, not malicious dynamic code execution.	ai	2026/04/24
source-diff	net-exec-file:docs/vendors~main-922810af37ca1f31df79.js	AI (source-diff): Vendors bundle for demo page containing React + emotion CSS-in-JS. DOM style injection (document.createElement) is not a network call; new Function() is standard in emotion. Not a dropper.	ai	2026/04/24
source-diff	obfuscated-file:docs/main-922810af37ca1f31df79.js	AI (source-diff): This is a webpack-bundled demo/docs asset, not library code. The main entry is dist/index.js. Minified webpack output in docs/ is expected for this package.	ai	2026/04/24
phantom-deps	phantom-dep:babel-runtime	AI (phantom-deps): babel-runtime is a standard Babel 6 runtime dependency used with transform-runtime plugin; its indirect usage pattern is expected and benign for this package.	ai	2026/04/24
npm-metadata	suspicious-initial-version	AI (npm-metadata): Version 0.0.0 is the legitimate first release of this 9-year-old established package with 160 subsequent versions. Not a throwaway malicious package.	ai	2026/04/24

Versions (showing 6 of 106)

Version	Deps	Published
0.0.5	3 / 16	2017-07-04
0.0.4	3 / 16	2017-07-04
0.0.3	3 / 16	2017-07-04
0.0.2	3 / 16	2017-07-04
0.0.1	3 / 16	2017-07-04
0.0.0	3 / 16	2017-07-04