← Home

@umijs/bundler-vite

npm Repository Homepage

@umijs/bundler-vite

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sorryccchenshuai2144kuitospeachscriptxiaohuoniyifankakaxixierenyuanxusd320zoomdong07

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): Long-lived UmiJS monorepo package; version bump with no material changes, consistent with normal release cadence resumption. ai
bogus-package bogus-package AI (bogus-package): Sparse metadata is typical for internal monorepo packages; package has 531 versions and legitimate ecosystem use. ai
dependencies unvetted-dep:@umijs/utils AI (dependencies): Sibling package in the UmiJS monorepo, versioned in lockstep; stable false positive for this package. ai
dependencies unvetted-dep:@umijs/bundler-utils AI (dependencies): Sibling package in the UmiJS monorepo, versioned in lockstep; stable false positive for this package. ai
phantom-deps phantom-dep:less AI (phantom-deps): less is an externalized compiled dep per compiledConfig; not directly imported but legitimately declared. ai
phantom-deps phantom-dep:core-js AI (phantom-deps): core-js is a known implicit runtime polyfill dependency for bundlers; stable false positive for this package. ai
semgrep semgrep:dynamic-require AI (semgrep): Fires inside compiled/vendored @vitejs/plugin-legacy bundle; expected pattern for a bundler package that vendors deps. ai

Versions (showing 51 of 196)

View all versions
Version Deps Published
4.6.82 11 / 5
4.6.81 11 / 5
4.6.80 11 / 5
4.6.79 11 / 5
4.6.78 11 / 5
4.6.77 11 / 5
4.6.76 11 / 5
4.6.69 11 / 5
4.6.68 11 / 5
4.6.67 10 / 5
4.6.66 10 / 5
4.6.65 10 / 5
4.6.64 10 / 5
4.6.63 10 / 5
4.6.62 10 / 5
4.6.61 10 / 5
4.6.59 10 / 5
4.6.58 10 / 5
4.6.57 10 / 5
4.6.56 10 / 5
4.6.55 10 / 5
4.6.54 10 / 5
4.6.53 10 / 5
4.6.52 10 / 5
4.6.51 10 / 5
4.6.50 10 / 5
4.6.49 10 / 5
4.6.48 10 / 5
4.6.47 10 / 5
4.6.46 10 / 5
4.6.45 10 / 5
4.6.44 10 / 5
4.6.43 10 / 5
4.6.42 10 / 5
4.6.41 10 / 5
4.6.40 10 / 5
4.6.39 10 / 5
4.6.38 10 / 5
4.6.37 10 / 5
4.6.36 10 / 5
4.6.35 10 / 5
4.6.34 10 / 5
4.6.33 10 / 5
4.6.32 10 / 5
4.6.31 10 / 5
4.6.30 10 / 5
4.6.29 10 / 5
4.6.28 10 / 5
4.6.27 10 / 5
4.6.26 10 / 5
4.6.25 10 / 5

v4.6.82

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.81

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.80

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.79

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.78

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.77

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.76

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: zoomdong07 → GitHub Actions (on 2026-07-15, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zoomdong07) on 2026-07-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.6.69

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.