storybook
Storybook: Develop, document, and test UI components in isolation
100
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
ndelangentmeasdayghengeveldkasperpeulenshilmanjreinholdvalentinpalkovicstorybook-bot
Keywords
storybookcomponentcomponentsdesign-systemscomponent-testingreactnextnext.jsreact-nativereact-native-webvueangularsveltesveltekitweb-components
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/_node-chunks/chunk-PNYLLFX3.js | AI (source-diff): Bundled chunk with CJS compat shim; standard Storybook build output. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-CXHD3UA6.js | AI (source-diff): Bundled babel/types chunk with CJS compat shim; standard Storybook build output. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/builder-manager-H3RE756K.js | AI (source-diff): Bundled esbuild output with CJS compat shim; expected for Storybook's builder-manager chunk. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/builder-manager-SBMOFRIH.js | AI (source-diff): Bundled build-tool chunk with expected network+require patterns; stable FP for storybook. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-WOCJUYI6.js | AI (source-diff): Bundled build-tool chunk with expected network+require patterns; stable FP for storybook. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-WKCYHYMS.js | AI (source-diff): Bundled build-tool chunk with expected network+require patterns; stable FP for storybook. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/builder-manager-UBFFXMB4.js | AI (source-diff): Builder-manager with bundled ejs/node APIs is core Storybook functionality. | ai | |
| source-diff | obfuscated-file:dist/_browser-chunks/syntaxhighlighter-OH4MV7E3.js | AI (source-diff): Minified syntax-highlighter grammars bundled by esbuild; standard for Storybook. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/mdx-N42X6CFJ-63AUQLMU.js | AI (source-diff): Bundled acorn/MDX parser output from esbuild; expected for this package. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-H4PWFMMO.js | AI (source-diff): Core server chunk with node APIs; expected for Storybook's dev server. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-MKXM7JNE.js | AI (source-diff): Bundled babel types/transforms chunk; standard build output. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/mdx-N42X6CFJ-63AUQLMU.js | AI (source-diff): MDX compiler chunk with node APIs; expected for docs processing. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Storybook bundles many deps into dist chunks; large file count is normal. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/mdx-N42X6CFJ-ODHTGV2Q.js | AI (source-diff): Bundled @storybook/docs-mdx with acorn parser; long lines are Unicode char code arrays from acorn, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-JXXWBFBF.js | AI (source-diff): Same Storybook esbuild CJS compat banner pattern; bundled @babel/types and related libs, no malicious patterns. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/chunk-GOY6UMCB.js | AI (source-diff): Same Storybook esbuild CJS compat banner pattern; bundled third-party libs, no malicious network/exec patterns. | ai | |
| phantom-deps | phantom-dep:@testing-library/jest-dom | AI (phantom-deps): Testing library loaded by convention in Storybook test setup; stable false positive. | ai | |
| phantom-deps | phantom-dep:@testing-library/user-event | AI (phantom-deps): Testing library loaded by convention in Storybook test setup; stable false positive. | ai | |
| phantom-deps | phantom-dep:@vitest/expect | AI (phantom-deps): Testing framework package loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@vitest/spy | AI (phantom-deps): Testing framework package loaded by convention in Storybook's test utilities; not a real phantom dep concern. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/builder-manager-EYIS5ER3.js | AI (source-diff): Storybook's esbuild build process bundles deps into node chunks with CJS compat banners; network+exec pattern is from bundled libs (ejs, babel), not malware. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/mdx-N42X6CFJ-ODHTGV2Q.js | AI (source-diff): Long lines are acorn parser Unicode character code data arrays — a well-known pattern in JS parsers, not obfuscation. | ai |
Versions (showing 100 of 673)
Showing 100 of 673
Next page →