“This package contains the react implementation of [Components 2.0](https://www.figma.com/file/HmokLgpDo4ogI5l5hpNApf/Sprout-Core-Components…”
AI
Legitimate UI component library
Local reference
Suspicious dependency
Inferred
Mal-ecule
O(Ca)H₆(Cm₅Db₂F₄Os₄Po₂U₂)Md₂(Pa₅)
Loading file contents…
Loading traits…
Identity
| SHA-256 | 9fa3e92e21ad848e1903130d79d06cc1e6c19ac4b2d48ad822850d3656cb70d5 |
|---|---|
| Canonical SHA-256 | 004c80cef8eedb2b2eec071819dc07bc2aa4814858d90a10d83f1653a0c10520 |
| Filename | @qlik-sprout-react-6.45.2.tgz |
| Package | @qlik/sprout-react |
| Version | 6.45.3 |
| PURL | pkg:npm/%40qlik/[email protected] |
Origin
| Source | forager |
|---|---|
| Feed | supplychainattack.org |
| Ecosystem | javascript |
| Domain | npmjs.org |
| URL | https://registry.npmjs.org/@qlik/sprout-react/-/sprout-react-6.45.2.tgz |
Timeline
| First seen | 4 Aug 2026 19:32 UTC |
|---|---|
| First analyzed | 5 Aug 2026 23:47 UTC |
| Last analyzed | 5 Aug 2026 23:47 UTC |
| Last updated | 5 Aug 2026 23:47 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | promoter |
| Traits version | b5ca8 |
Not seeing what you expected? Let us know