@nuxt/schema — Greenflagged

Nuxt types and default configuration

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

nuxtbot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:dist/_chunks/libs/@unhead/vue.d.mts	AI (source-diff): Type declaration file; token matches, no actual network/exec code.	ai	2026/07/13
source-diff	obfuscated-file:dist/_chunks/libs/@unhead/vue.d.mts	AI (source-diff): Bundled .d.mts declaration file; long type lines, not obfuscation.	ai	2026/07/13
source-diff	obfuscated-file:dist/_chunks/libs/@babel/parser.d.mts	AI (source-diff): Long lines are TS type-union declarations in bundled .d.mts, not obfuscation.	ai	2026/07/13
maintainer-change	maintainer-takeover	AI (maintainer-change): Nuxt org moved to nuxtbot CI publishing; SLSA provenance confirms legitimate transition.	ai	2026/06/03
bogus-package	bogus-package	AI (bogus-package): Official Nuxt package; README links and missing keywords are not spam indicators here.	ai	2026/06/03
maintainer-change	maintainer-added	AI (maintainer-change): nuxtbot is the Nuxt org's CI bot account; stable across future versions.	ai	2026/06/03
phantom-deps	phantom-dep:jiti	AI (phantom-deps): jiti is used indirectly via config resolution at runtime; phantom-dep pattern is expected for this package type.	ai	2026/04/23
dependencies	unvetted-dep:jiti	AI (dependencies): jiti is a legitimate TypeScript/ESM runtime loader, a core dependency in the Nuxt/Vite ecosystem. No malicious signals; stable use across many Nuxt versions.	ai	2026/04/23
dependencies	unvetted-dep:postcss-import-resolver	AI (dependencies): postcss-import-resolver is a standard PostCSS utility with no malicious signals; its use in a schema package for CSS config resolution is expected.	ai	2026/04/23
phantom-deps	phantom-dep:c12	AI (phantom-deps): c12 is a Nuxt config loader used indirectly at runtime; phantom-dep pattern is expected for schema/config packages.	ai	2026/04/23
phantom-deps	phantom-dep:scule	AI (phantom-deps): scule is a string utility used indirectly; phantom-dep pattern is expected for schema/config packages.	ai	2026/04/23
phantom-deps	phantom-dep:create-require	AI (phantom-deps): create-require is a CJS compatibility shim used indirectly; phantom-dep pattern is expected for this package.	ai	2026/04/23
dependencies	unvetted-dep:@nuxt/ui-templates	AI (dependencies): @nuxt/ui-templates is a first-party Nuxt package; unvetted status is a false positive for ecosystem packages.	ai	2026/04/23
dependencies	unvetted-dep:uncrypto	AI (dependencies): uncrypto is a UnJS ecosystem utility for cross-runtime crypto. Legitimate dependency maintained by the same Nuxt/UnJS team.	ai	2026/04/23
dependencies	unvetted-dep:compatx	AI (dependencies): compatx is a UnJS ecosystem utility, the same org as Nuxt. Legitimate dependency with stable usage across Nuxt versions.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): Transition from danielroe to GitHub Actions CI/CD with SLSA provenance is a standard, secure publishing practice for the Nuxt framework.	ai	2026/04/23
maintainer-change	maintainer-removed	AI (maintainer-change): Removed maintainers are known Nuxt core team; reflects shift to automated CI/CD publishing with provenance attestation.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): pkg-types is a legitimate UnJS ecosystem package maintained by the same org as Nuxt; its addition to @nuxt/schema is expected and benign.	ai	2026/04/23
dependencies	unvetted-dep:defu	AI (dependencies): defu is a well-known UnJS utility maintained by the same Nuxt/UnJS team; standard dependency across the Nuxt ecosystem.	ai	2026/04/21
dependencies	unvetted-dep:pkg-types	AI (dependencies): pkg-types is a stable utility package widely used in the Nuxt ecosystem; unvetted status does not reflect actual risk.	ai	2026/04/21