react-tools
A set of complementary tools to React, including the JSX transformer.
15
Versions
BSD-3-Clause
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
zpaojeffmo
Keywords
reactjsxtransformerview
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:esprima-fb | AI (dependencies): esprima-fb is a Facebook-maintained esprima fork used in early React toolchain; expected dependency for this legacy package across all versions. | ai | |
| npm-metadata | url-dep:esprima | AI (npm-metadata): Facebook's esprima fork (fb-harmony branch) was a deliberate, documented dependency for harmony syntax support in early React tooling. Hosted under the facebook GitHub org; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package is 4710 days old, predating Sigstore provenance by years. Absence of attestation is expected and not a security concern for this legacy package. | ai | |
| phantom-deps | phantom-dep:commoner | AI (phantom-deps): commoner is a known React build toolchain dependency from this era; phantom declaration is a benign metadata artifact, not a security risk. | ai |