@uniformdev/uniform-mcp

Uniform MCP Server

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

drolexanalenpelinkamsaradamluniformoriginalexem1r1kjakub-uniformserhiiouniformdev

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs	AI (source-diff): File is a bundled icon library (react-icons/css-gg SVG components); minified but not obfuscated or malicious.	ai	2026/05/12
phantom-deps	phantom-dep:zod	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:lexical	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@lexical/code	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@lexical/list	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@lexical/table	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@lexical/headless	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@lexical/markdown	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@lexical/rich-text	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:@modelcontextprotocol/sdk	AI (phantom-deps): Declared and used; heuristic false positive for this package.	ai	2026/05/12
source-diff	encoded-string-file:dist/server.mjs	AI (source-diff): Same pattern as index.mjs — bundled ariakit/React code, not malicious encoding.	ai	2026/05/01
source-diff	encoded-string-file:dist/index.mjs	AI (source-diff): Long string is readable bundled UI library code (ariakit), not obfuscation; stable pattern for this package.	ai	2026/05/01
phantom-deps	phantom-dep:uuid	AI (phantom-deps): Referenced in config files; stable false positive for this bundled package.	ai	2026/04/30
phantom-deps	phantom-dep:immer	AI (phantom-deps): Referenced in config files; stable false positive for this bundled package.	ai	2026/04/30
phantom-deps	phantom-dep:linkedom	AI (phantom-deps): Referenced in config files; stable false positive for this bundled package.	ai	2026/04/30
phantom-deps	phantom-dep:@uniformdev/canvas	AI (phantom-deps): Same-org scoped package; indirect import via bundled dist is expected pattern.	ai	2026/04/30
phantom-deps	phantom-dep:@types/uuid	AI (phantom-deps): Type-only package loaded by convention; stable false positive.	ai	2026/04/30
bogus-package	bogus-package	AI (bogus-package): Scoped enterprise SDK; no public repo/homepage is common for org-internal distribution.	ai	2026/04/30
phantom-deps	phantom-dep:fast-json-patch	AI (phantom-deps): Referenced in config files; stable false positive for this bundled package.	ai	2026/04/30
phantom-deps	phantom-dep:@uniformdev/project-map	AI (phantom-deps): Same-org scoped package; indirect import via bundled dist is expected pattern.	ai	2026/04/30

Versions (showing 51 of 58)

View all versions

Version	Deps	Published
20.63.0	9 / 4	2026-05-14
20.61.1	9 / 4	2026-05-07
20.60.2	9 / 4	2026-04-28
20.60.1	9 / 4	2026-04-23
20.60.0	9 / 4	2026-04-21
20.59.1	9 / 4	2026-04-16
20.58.0	9 / 4	2026-04-14
20.57.1	9 / 4	2026-04-09
20.56.0	9 / 4	2026-03-31
20.55.2	9 / 4	2026-03-26
20.55.1	9 / 4	2026-03-24
20.55.0	9 / 4	2026-03-19
20.54.0	9 / 4	2026-03-17
20.53.1	9 / 4	2026-03-12
20.53.0	9 / 4	2026-03-10
20.51.0	9 / 4	2026-03-05
20.50.2	9 / 4	2026-03-03
20.50.1	9 / 4	2026-02-26
20.50.0	9 / 4	2026-02-19
20.49.4	9 / 4	2026-02-12
20.49.3	9 / 4	2026-02-09
20.49.2	9 / 5	2026-01-29
20.49.1	9 / 5	2026-01-27
20.49.0	9 / 5	2026-01-23
20.48.0	9 / 5	2026-01-20
20.47.1	9 / 5	2026-01-15
20.47.0	9 / 6	2026-01-08
20.46.0	9 / 6	2025-12-11
20.45.0	9 / 6	2025-12-09
20.43.1	9 / 6	2025-12-02
20.43.0	9 / 6	2025-11-21
20.42.1	9 / 6	2025-11-11
20.42.0	9 / 6	2025-11-06
20.41.0	9 / 6	2025-11-04
20.40.0	9 / 6	2025-10-30
20.39.1	9 / 6	2025-10-21
20.39.0	6 / 5	2025-10-17
20.38.1	6 / 5	2025-10-15
20.37.0	6 / 5	2025-09-30
20.36.1	5 / 5	2025-09-25
20.36.0	5 / 5	2025-09-23
20.35.0	5 / 5	2025-09-18
20.34.1	5 / 5	2025-09-11
20.32.2	5 / 5	2025-09-02
20.32.1	5 / 5	2025-08-28
20.32.0	5 / 5	2025-08-26
20.31.0	5 / 5	2025-08-21
20.30.1	5 / 5	2025-08-20
20.30.0	5 / 5	2025-08-14
20.27.1	5 / 5	2025-08-06
20.26.2	5 / 5	2025-07-31

v20.63.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.61.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.60.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.60.1

3 findings

HIGH Long encoded string in modified file: dist/index.mjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/server.mjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.60.0

2 findings

HIGH Long encoded string in modified file: dist/index.mjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.59.1

2 findings

HIGH Long encoded string in modified file: dist/index.mjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.58.0

2 findings

HIGH Long encoded string in modified file: dist/index.mjs source-diff

Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.57.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.56.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.55.2

2 findings

HIGH New obfuscated file: dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.55.1

2 findings

HIGH New obfuscated file: dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.55.0

2 findings

HIGH New obfuscated file: dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.54.0

2 findings

HIGH New obfuscated file: dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.53.1

2 findings

HIGH New obfuscated file: dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.53.0

2 findings

HIGH New obfuscated file: dist/importedIcons-NFIA4IOK-ZOYCUN2F.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.51.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.50.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.50.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.50.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.49.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.49.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.49.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.49.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.49.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.48.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.47.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.47.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.46.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.45.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.43.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.42.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.42.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.41.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.39.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.39.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.38.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.36.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.34.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.32.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.32.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.32.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.31.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.30.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.30.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.27.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.26.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.