← Home

@umijs/plugins

npm Repository Homepage

@umijs/plugins

100
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sorryccchenshuai2144kuitospeachscriptxiaohuoniyifankakaxixierenyuanxusd320zoomdong07

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): Established UmiJS monorepo package; no material changes from prior version; publisher has approved track record. ai
dependencies unvetted-dep:dva-immer AI (dependencies): Known UmiJS ecosystem dependency; stable across versions of this package. ai
dependencies unvetted-dep:dva-core AI (dependencies): Known UmiJS ecosystem dependency; stable across versions of this package. ai
dependencies unvetted-dep:dva-loading AI (dependencies): Known UmiJS ecosystem dependency; stable across versions of this package. ai
dependencies unvetted-dep:@umijs/valtio AI (dependencies): First-party @umijs scoped package; stable for this package. ai
dependencies unvetted-dep:@umijs/bundler-utils AI (dependencies): First-party @umijs scoped package; stable for this package. ai
dependencies unvetted-dep:antd-dayjs-webpack-plugin AI (dependencies): Known Ant Design ecosystem plugin; stable for this package. ai
dependencies unvetted-dep:@ant-design/antd-theme-variable AI (dependencies): Known Ant Design scoped package; stable for this package. ai
dependencies unvetted-dep:@ant-design/moment-webpack-plugin AI (dependencies): Known Ant Design scoped package; stable for this package. ai
phantom-deps phantom-dep:@tanstack/react-query AI (phantom-deps): Plugin package; referenced in generated config/templates, not directly imported. ai
phantom-deps phantom-dep:@tanstack/react-query-devtools AI (phantom-deps): Plugin package; referenced in generated config/templates, not directly imported. ai
phantom-deps phantom-dep:styled-components AI (phantom-deps): Plugin package; referenced in generated config/templates, not directly imported. ai
phantom-deps phantom-dep:moment AI (phantom-deps): Plugin package; referenced in generated config/templates, not directly imported. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): Known implicit runtime dependency for TypeScript compiled output. ai
phantom-deps phantom-dep:@ant-design/pro-components AI (phantom-deps): Plugin package; dependency is injected into user projects, not directly imported. ai
bogus-package bogus-package AI (bogus-package): Monorepo package; sparse metadata is consistent across all @umijs/* packages. ai

Versions (showing 100 of 225)

Version Deps Published
4.6.82 31 / 2
4.6.81 31 / 2
4.6.80 31 / 2
4.6.79 31 / 2
4.6.78 31 / 2
4.6.77 31 / 2
4.6.76 31 / 2
4.6.75 31 / 2
4.6.69 31 / 2
4.6.68 31 / 2
4.6.67 31 / 2
4.6.66 31 / 2
4.6.65 31 / 2
4.6.64 31 / 2
4.6.63 30 / 2
4.6.62 30 / 2
4.6.61 30 / 2
4.6.59 30 / 2
4.6.58 30 / 2
4.6.57 30 / 2
4.6.56 30 / 2
4.6.55 30 / 2
4.6.54 30 / 2
4.6.53 30 / 2
4.6.52 30 / 2
4.6.51 30 / 2
4.6.50 30 / 2
4.6.49 30 / 2
4.6.48 30 / 2
4.6.47 30 / 2
4.6.46 30 / 2
4.6.45 30 / 2
4.6.44 30 / 2
4.6.43 30 / 2
4.6.42 30 / 2
4.6.41 30 / 2
4.6.40 30 / 2
4.6.39 30 / 2
4.6.38 30 / 2
4.6.37 30 / 2
4.6.14 30 / 2
4.6.13 30 / 2
4.6.12 30 / 2
4.6.11 30 / 2
4.6.10 30 / 2
4.6.9 30 / 2
4.6.8 30 / 2
4.6.7 30 / 2
4.6.6 30 / 2
4.6.5 30 / 2
4.6.4 30 / 2
4.6.3 30 / 2
4.6.2 30 / 2
4.6.1 30 / 2
4.5.3 30 / 2
4.5.1 30 / 2
4.5.0 30 / 2
4.4.12 30 / 2
4.4.11 30 / 2
4.4.10 30 / 2
4.4.9 30 / 2
4.4.8 30 / 2
4.4.7 30 / 2
4.4.6 30 / 2
4.4.5 30 / 2
4.4.4 30 / 2
4.4.3 30 / 2
4.4.2 30 / 2
4.4.1 30 / 2
4.4.0 30 / 2
4.3.36 30 / 2
4.3.35 30 / 2
4.3.34 30 / 2
4.3.33 30 / 2
4.3.32 30 / 2
4.3.31 30 / 2
4.3.30 30 / 2
4.3.29 30 / 2
4.3.28 30 / 2
4.3.27 30 / 2
4.3.26 30 / 2
4.3.25 30 / 2
4.3.24 30 / 2
4.3.23 30 / 2
4.3.22 30 / 2
4.3.21 30 / 2
4.3.20 30 / 2
4.3.19 30 / 2
4.3.18 30 / 2
4.3.17 30 / 2
4.3.16 30 / 2
4.3.15 30 / 2
4.3.14 30 / 2
4.3.13 30 / 2
4.3.12 30 / 2
4.3.11 30 / 2
4.3.10 30 / 2
4.3.9 30 / 2
4.3.8 30 / 2
4.3.7 30 / 2
Showing 100 of 225 Next page →

v4.6.82

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.81

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.80

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.79

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.78

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.77

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.76

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: zoomdong07 → GitHub Actions (on 2026-07-15, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zoomdong07) on 2026-07-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.6.75

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: zoomdong07 → GitHub Actions (on 2026-07-10, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zoomdong07) on 2026-07-10, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.6.69

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.36

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.35

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.34

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.33

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.28

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.27

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.25

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.24

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.3.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.