← Home

@umijs/zod2ts

npm Repository Homepage

@umijs/zod2ts

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

sorryccchenshuai2144kuitospeachscriptxiaohuoniyifankakaxixierenyuanxusd320zoomdong07

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Legitimate @umijs monorepo sub-package; sparse metadata is normal for internal scoped packages. ai

Versions (showing 51 of 190)

View all versions
Version Deps Published
4.6.82 0 / 0
4.6.81 0 / 0
4.6.80 0 / 0
4.6.79 0 / 0
4.6.78 0 / 0
4.6.77 0 / 0
4.6.76 0 / 0
4.6.69 0 / 0
4.6.68 0 / 0
4.6.67 0 / 0
4.6.66 0 / 0
4.6.65 0 / 0
4.6.64 0 / 0
4.6.63 0 / 0
4.6.62 0 / 0
4.6.61 0 / 0
4.6.59 0 / 0
4.6.58 0 / 0
4.6.57 0 / 0
4.6.56 0 / 0
4.6.55 0 / 0
4.6.54 0 / 0
4.6.53 0 / 0
4.6.52 0 / 0
4.6.51 0 / 0
4.6.50 0 / 0
4.6.49 0 / 0
4.6.48 0 / 0
4.6.47 0 / 0
4.6.46 0 / 0
4.6.45 0 / 0
4.6.44 0 / 0
4.6.43 0 / 0
4.6.42 0 / 0
4.6.41 0 / 0
4.6.40 0 / 0
4.6.39 0 / 0
4.6.38 0 / 0
4.6.37 0 / 0
4.6.36 0 / 0
4.6.35 0 / 0
4.6.34 0 / 0
4.6.33 0 / 0
4.6.32 0 / 0
4.6.31 0 / 0
4.6.30 0 / 0
4.6.29 0 / 0
4.6.28 0 / 0
4.6.27 0 / 0
4.6.26 0 / 0
4.6.25 0 / 0

v4.6.82

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.81

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.80

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.79

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.78

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.77

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.6.76

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: zoomdong07 → GitHub Actions (on 2026-07-15, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zoomdong07) on 2026-07-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v4.6.69

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.