When digital sovereignty is discussed, cloud providers and operating systems take center stage. Frontend dependencies – the npm packages an application builds upon – remain largely invisible. Yet the jurisdiction of the package maintainer determines which legal framework governs an application’s logic layer.

The Invisible Risk

A typical React application has 200–800 npm dependencies. Most are maintained by individuals or small US teams. When a headless library provides logic for dialogs, menus, tabs, and forms, it’s not an optional dependency – it’s structural infrastructure.

The risk isn’t theoretical. The left-pad crisis of 2016 showed how a single 11-line package can break thousands of builds. The colors.js sabotage of 2022 demonstrated that actively maintained packages can be compromised overnight.

Jurisdictional Analysis

US jurisdiction: Radix Primitives (WorkOS), React Aria (Adobe), Headless UI (Tailwind Labs). These libraries are subject to US law, including the CLOUD Act.

EU jurisdiction: Base UI (MUI, incorporated in France). MUI is the only major component library provider under EU jurisdiction. License changes are subject to European contract law, no export control risk, and EU courts have jurisdiction in disputes.

Community projects (no clear jurisdiction): Melt UI, Bits UI, Ark UI, Kobalte. No corporate structure means no clear jurisdiction – both an advantage and a risk.

License Stability

Several prominent open-source projects have changed licenses recently – Terraform switched from MPL to BSL, Redis introduced module license restrictions. In the frontend space, this hasn’t happened yet, but the risk exists especially with VC-funded projects.

Library
Operator
Jurisdiction
License
VC-funded
Radix
WorkOS
US/Delaware
MIT
Yes
React Aria
Adobe
US/Delaware
Apache 2.0
No (Public)
Base UI
MUI
France
MIT
Yes
Melt UI
Community
None
MIT
No

Risk Mitigation

Organizations can minimize jurisdictional risk by: pinning headless libraries and auditing regularly, minimizing the number of headless dependencies, defining mirror/fork strategies for critical dependencies, preferring community projects under EU-friendly licenses, and checking license history for VC-funded projects.

Key Takeaways

  • The headless provider’s jurisdiction determines which legal framework governs your design system’s logic layer.
  • Base UI (MUI, France) is the only major provider under EU jurisdiction.
  • VC-funded projects carry higher license change risk – the Terraform BSL switch is a warning signal.
  • Frontend dependencies deserve the same security assessment as cloud services and operating systems.