← Home

@pdfme/ui

npm Repository Homepage

TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!

9
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

hand-dot

Keywords

pdfpdf-designerpdf-generationpdf-viewerreacttypescript

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/index.js AI (source-diff): Standard Vite-bundled output for a React UI library; long lines are minified CSS/JS, not obfuscation. ai
source-diff net-exec-file:dist/index.js AI (source-diff): Network calls and dynamic code in bundled UI library are expected (fetch for PDF ops, dynamic imports); no dropper pattern visible. ai
source-diff source-size-tripled AI (source-diff): Size increase reflects bundling of antd/form-render/etc. into the dist; consistent with Vite library build change. ai
source-diff encoded-string-file:dist/index.js AI (source-diff): Encoded strings are base64-compressed font data from @pdf-lib/standard-fonts, decompressed via pako.inflate — standard PDF font embedding pattern. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
phantom-deps phantom-dep:dompurify AI (phantom-deps): Bundled UI package; deps may be consumed indirectly via build output. ai
phantom-deps phantom-dep:react-dom AI (phantom-deps): Peer/bundled dep; expected in a React UI library. ai
phantom-deps phantom-dep:hotkeys-js AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:form-render AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
typosquat typosquat.levenshtein:uuid AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
phantom-deps phantom-dep:rc-field-form AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:@pdfme/converter AI (phantom-deps): Same-org package; expected sibling dependency. ai
phantom-deps phantom-dep:@dnd-kit/sortable AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:@dnd-kit/utilities AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
phantom-deps phantom-dep:lucide-react AI (phantom-deps): Bundled UI package; stable false positive for this package. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped package @pdfme/ui; Levenshtein match to short names is a false positive. ai

Versions (showing 9 of 9)

Version Deps Published
6.1.5 15 / 11
6.1.3 15 / 11
6.1.2 15 / 11
6.1.1 15 / 11
6.1.0 15 / 11
6.0.6 15 / 11
6.0.5 15 / 11
6.0.3 15 / 11
6.0.0 15 / 11

v6.1.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.1.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.1.2

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 13 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.1.1

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 13 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.1.0

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 13 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.5

3 findings
HIGH New obfuscated file: dist/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/index.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.