← Home

@univerjs/core

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jikkaiwbfsamengshukeji

Keywords

univeroffice-sdkcoreruntimefacade

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:dayjs AI (phantom-deps): Likely used in bundled/minified output; benign like the already-accepted nanoid/numeral phantom deps. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Minified bundle output using Reflect.get for property access, not evasive obfuscation. ai
phantom-deps phantom-dep:numfmt AI (phantom-deps): Used via config, stable pattern for this monorepo package. ai
phantom-deps phantom-dep:numeral AI (phantom-deps): Used via config, stable pattern for this monorepo package. ai
phantom-deps phantom-dep:kdbush AI (phantom-deps): kdbush is a declared dependency used in bundled output; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:nanoid AI (phantom-deps): nanoid is a declared dependency used in bundled output; phantom-dep heuristic false positive for this package. ai
typosquat typosquat.levenshtein:cors AI (typosquat): @univerjs/core is the core of the Univer framework, not a typo of cors; scoped package name makes this a stable false positive. ai

Versions (showing 51 of 108)

View all versions
Version Deps Published
0.25.1 11 / 7
0.25.0 11 / 7
0.24.0 11 / 7
0.23.0 11 / 7
0.22.1 11 / 7
0.22.0 11 / 7
0.21.1 11 / 7
0.21.0 11 / 7
0.20.1 11 / 7
0.20.0 12 / 7
0.19.0 12 / 7
0.18.0 12 / 7
0.17.0 12 / 8
0.16.1 12 / 8
0.16.0 12 / 8
0.15.5 12 / 8
0.15.4 12 / 8
0.15.3 12 / 8
0.15.2 12 / 8
0.15.1 12 / 8
0.15.0 12 / 8
0.14.0 12 / 8
0.13.0 12 / 8
0.12.4 12 / 8
0.12.3 12 / 8
0.12.2 12 / 8
0.12.1 12 / 8
0.12.0 12 / 8
0.11.0 12 / 8
0.10.14 12 / 8
0.10.13 12 / 8
0.10.12 12 / 8
0.10.11 12 / 8
0.10.10 12 / 8
0.10.9 12 / 8
0.10.8 12 / 8
0.10.7 12 / 8
0.10.6 12 / 8
0.10.5 12 / 8
0.10.4 12 / 8
0.10.3 12 / 8
0.10.2 12 / 8
0.10.1 12 / 8
0.10.0 12 / 8
0.9.4 12 / 8
0.9.3 12 / 8
0.9.2 12 / 8
0.9.1 12 / 8
0.9.0 12 / 8
0.8.3 12 / 8
0.8.2 12 / 8

v0.25.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.