redbox-react — Greenflagged

A redbox (rsod) component to display your errors.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

davidpfahlermxlje

Keywords

redboxrsodreactreact-native

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size increase is entirely due to two 1.6MB webpack-compiled example bundles being added. No injected payload.	ai	2026/04/24
source-diff	net-exec-file:examples/babel-plugin-react-hot/dist/bundle.js	AI (source-diff): This is a webpack HMR bundle in an examples directory. The network calls and dynamic script injection are standard webpack hot-reload boilerplate, not malware.	ai	2026/04/24
source-diff	net-exec-file:examples/react-hot-loader-example/dist/bundle.js	AI (source-diff): Same as above — webpack HMR runtime in an examples directory. Standard hot-reload boilerplate, not malicious.	ai	2026/04/24
maintainer-change	maintainer-removed	AI (maintainer-change): Removal of keywordbrain is consistent with a legitimate ownership transfer to the actual project authors.	ai	2026/04/24
maintainer-change	maintainer-takeover	AI (maintainer-change): Transfer from keywordbrain to davidpfahler/mxlje is legitimate — author field and GitHub repo both reference David Pfahler as the actual project author. No code changes introduced.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Publisher change in 2016 aligns with legitimate authorship transfer; new publisher mxlje has a long, clean track record (35 approved, 0 rejected).	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): New maintainers are the documented authors of the project; no malicious signals in the package content.	ai	2026/04/24
email-domain	unclaimed-email:keywordbrain.com	AI (email-domain): Long-established package (10+ years, 34 versions, consistent publisher history). Unclaimed domain is a latent risk but no evidence of active compromise or takeover across the package's history.	ai	2026/04/24

Versions (showing 34 of 34)

Version	Deps	Published
1.6.0	4 / 22	2018-04-26
1.5.0	4 / 22	2017-08-01
1.4.3	4 / 22	2017-07-07
1.4.2	4 / 22	2017-06-14
1.4.1	4 / 22	2017-06-10
1.4.0	4 / 22	2017-06-02
1.3.7	4 / 22	2017-05-31
1.3.6	3 / 16	2017-04-09
1.3.5	2 / 17	2017-04-08
1.3.4	2 / 16	2017-02-20
1.3.3	2 / 16	2016-11-08
1.3.2	2 / 15	2016-10-15
1.3.1	3 / 15	2016-09-20
1.3.0	3 / 15	2016-08-08
1.2.10	3 / 15	2016-06-30
1.2.9	3 / 15	2016-06-20
1.2.8	3 / 15	2016-06-17
1.2.7	3 / 15	2016-06-17
1.2.6	2 / 13	2016-05-25
1.2.5	2 / 13	2016-05-18
1.2.4	2 / 13	2016-05-03
1.2.3	2 / 12	2016-04-07
1.2.2	2 / 12	2016-02-02
1.2.1	2 / 12	2016-02-02
1.2.0	2 / 12	2015-11-17
1.1.1	2 / 11	2015-09-25
1.1.0	1 / 11	2015-09-21
1.0.6	1 / 11	2015-09-20
1.0.5	1 / 11	2015-09-16
1.0.4	1 / 11	2015-09-14
1.0.3	1 / 16	2015-09-09
1.0.2	1 / 16	2015-09-07
1.0.1	1 / 16	2015-09-03
1.0.0	1 / 16	2015-07-28

v1.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.0

3 findings

HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (keywordbrain) were replaced by new maintainers (davidpfahler, mxlje). This is a strong signal of a potential package hijack and requires careful review.

HIGH Publisher changed: keywordbrain → mxlje (on 2016-08-08) provenance

This version was published by a different npm account than previous versions on 2016-08-08. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.3

2 findings

HIGH Unclaimed maintainer email domain: keywordbrain.com email-domain

Maintainer email '[email protected]' uses domain 'keywordbrain.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

3 findings

HIGH New file with network + code execution: examples/babel-plugin-react-hot/dist/bundle.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: examples/react-hot-loader-example/dist/bundle.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.