← Home

@pdfme/ui

npm Repository Homepage

TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!

16
Versions
MIT
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

hand-dot

Keywords

pdfpdf-designerpdf-generationpdf-viewerreacttypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/index.js AI (source-diff): Standard Vite-bundled output for a React UI library; long lines are minified CSS/JS, not obfuscation. ai
source-diff net-exec-file:dist/index.js AI (source-diff): Network calls and dynamic code in bundled UI library are expected (fetch for PDF ops, dynamic imports); no dropper pattern visible. ai
source-diff source-size-tripled AI (source-diff): Size increase reflects bundling of antd/form-render/etc. into the dist; consistent with Vite library build change. ai
source-diff encoded-string-file:dist/index.js AI (source-diff): Encoded strings are base64-compressed font data from @pdf-lib/standard-fonts, decompressed via pako.inflate — standard PDF font embedding pattern. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
phantom-deps phantom-dep:dompurify AI (phantom-deps): Bundled UI package; deps may be consumed indirectly via build output. ai
phantom-deps phantom-dep:react-dom AI (phantom-deps): Peer/bundled dep; expected in a React UI library. ai
phantom-deps phantom-dep:hotkeys-js AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:form-render AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
typosquat typosquat.levenshtein:uuid AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
phantom-deps phantom-dep:rc-field-form AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:@pdfme/converter AI (phantom-deps): Same-org package; expected sibling dependency. ai
phantom-deps phantom-dep:@dnd-kit/sortable AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:@dnd-kit/utilities AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:lucide-react AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai

Versions (showing 16 of 16)

Version Deps Published
6.1.11 15 / 11
6.1.10 15 / 11
6.1.9 15 / 11
6.1.8 15 / 11
6.1.6 15 / 11
6.1.5 15 / 11
6.1.3 15 / 11
6.1.2 15 / 11
6.1.1 15 / 11
6.1.0 15 / 11
6.0.6 15 / 11
6.0.5 15 / 11
6.0.3 15 / 11
6.0.0 15 / 11
5.4.8 15 / 23
5.4.7 15 / 23

v6.1.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v5.4.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.4.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.