@lytjs/lytjs
Lyt.js - 轻写轻跑，所见即代码。零依赖超轻量前端框架聚合包
9
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
idcu
Keywords
lytlytjsjavascriptframeworkfrontendvue-likelightweightzero-dependencyreactivevdom
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Aggregator package with no material changes from prior version; missing gitHead reflects a publish environment change but no malicious indicators present. | ai | |
| phantom-deps | phantom-dep:@lytjs/vdom | AI (phantom-deps): Aggregation/umbrella package; @lytjs/vdom is a sibling workspace package bundled into dist output rather than directly imported in source. Same org scope, no external risk. | ai |