← Home

@umijs/ast

npm Repository Homepage

@umijs/ast

21
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sorryccchenshuai2144kuitospeachscriptxiaohuoniyifankakaxixierenyuanxusd320zoomdong07

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Sparse metadata is a known pattern for UmiJS monorepo sub-packages; not indicative of spam. ai
typosquat typosquat.levenshtein:jest AI (typosquat): @umijs/ast is a scoped UmiJS monorepo package; Levenshtein match to 'jest' is a mechanical false positive with no typosquat intent. ai
typosquat typosquat.levenshtein:got AI (typosquat): @umijs/ast is a scoped UmiJS monorepo package; Levenshtein match to 'got' is a mechanical false positive with no typosquat intent. ai
typosquat typosquat.levenshtein:qs AI (typosquat): @umijs/ast is a scoped UmiJS monorepo package; Levenshtein match to 'qs' is a mechanical false positive with no typosquat intent. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): @umijs/ast is a scoped UmiJS monorepo package; Levenshtein match to 'ajv' is a mechanical false positive with no typosquat intent. ai

Versions (showing 21 of 21)

Show 27 prereleases
Version Deps Published
4.6.82 1 / 0
4.6.81 1 / 0
4.6.80 1 / 0
4.6.79 1 / 0
4.6.78 1 / 0
4.6.77 1 / 0
4.6.76 1 / 0
4.6.69 1 / 0
4.6.68 1 / 0
4.6.67 1 / 0
4.6.66 1 / 0
4.6.65 1 / 0
4.6.64 1 / 0
4.6.63 1 / 0
4.6.62 1 / 0
4.6.61 1 / 0
4.6.59 1 / 0
4.6.58 1 / 0
4.6.57 1 / 0
4.6.56 1 / 0
4.6.47 1 / 0

v4.6.82

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.81

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.80

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.79

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.78

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.77

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.76

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: zoomdong07 → GitHub Actions (on 2026-07-15, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zoomdong07) on 2026-07-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.6.69

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.