schedule
Cooperative scheduler for the browser environment.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): object-assign is a standard Facebook/React polyfill dependency used across the React ecosystem. No malicious signal. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (acdlite, brianvaughn, fb, flarnie, gaearon, sophiebits, trueadm) are the official React core team at Facebook. Legitimate transfer. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Original author popomore voluntarily transferred the package to the React team. Removal is part of the documented legitimate handoff. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects a full React cooperative scheduler implementation replacing a minimal stub. Consistent with the package's stated purpose and React team ownership. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Legitimate transfer from original author (popomore) to the official Facebook/React core team. Repository is facebook/react; all new maintainers are well-known React contributors. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Flagged maintainers 'fb' and 'gaearon' are the official Facebook npm org and Dan Abramov — legitimate React ecosystem publishers. Short README is expected for this internal React scheduler package. | ai | |
| phantom-deps | phantom-dep:object-assign | AI (phantom-deps): Minor packaging inconsistency in a well-established React package; not a security concern. | ai | |
| provenance | publisher-changed | AI (provenance): gaearon (Dan Abramov) and brianvaughn (Brian Vaughn) are both documented React core team members at Facebook. This is a legitimate internal maintainer transition. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 0.5.0 | 1 / 0 | |
| 0.4.0 | 1 / 0 | |
| 0.3.0 | 1 / 0 | |
| 0.2.0 | 1 / 0 | |
| 0.1.0 | 0 / 6 |
v0.5.0
2 findingsThis version was published by a different npm account than previous versions on 2018-09-18. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-13. This could indicate a legitimate maintainer transition or an account compromise.
v0.3.0
3 findingsAll previous maintainers (popomore) were replaced by new maintainers (acdlite, brianvaughn, fb, flarnie, gaearon, sophiebits, trueadm). This is a strong signal of a potential package hijack and requires careful review.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-06. This could indicate a legitimate maintainer transition or an account compromise.
v0.2.0
3 findingsAll previous maintainers (popomore) were replaced by new maintainers (acdlite, brianvaughn, fb, flarnie, gaearon, sophiebits, trueadm). This is a strong signal of a potential package hijack and requires careful review.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2018-09-04. This could indicate a legitimate maintainer transition or an account compromise.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.