← Home

@univerjs/ui

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jikkaiwbfsamengshukeji

Keywords

univeruiworkbenchmenusreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:rc-util AI (phantom-deps): Likely used via bundled/re-exported UI components; common in Univer monorepo packages. ai
phantom-deps phantom-dep:@univerjs/icons AI (phantom-deps): Same-org dependency, likely re-exported in build output not scanned. ai
dependencies unvetted-dep:@wendellhu/redi AI (dependencies): Long-standing dependency in the univerjs ecosystem; stable across many approved versions. ai
phantom-deps phantom-dep:localforage AI (phantom-deps): localforage is a declared runtime dependency; phantom-dep heuristic misfires here. ai
typosquat typosquat.levenshtein:uuid AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to uuid is a false positive for this established monorepo package. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to yup is a false positive. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to pg is a false positive. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to qs is a false positive. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to joi is a false positive. ai

Versions (showing 51 of 108)

View all versions
Version Deps Published
0.25.1 6 / 11
0.25.0 6 / 11
0.24.0 6 / 11
0.23.0 6 / 11
0.22.1 6 / 11
0.22.0 6 / 11
0.21.1 6 / 11
0.21.0 6 / 11
0.20.1 6 / 11
0.20.0 6 / 11
0.19.0 6 / 11
0.18.0 6 / 11
0.17.0 6 / 12
0.16.1 6 / 12
0.16.0 6 / 12
0.15.5 6 / 12
0.15.4 6 / 12
0.15.3 6 / 12
0.15.2 6 / 12
0.15.1 6 / 12
0.15.0 6 / 12
0.14.0 6 / 12
0.13.0 6 / 12
0.12.4 6 / 12
0.12.3 6 / 12
0.12.2 6 / 12
0.12.1 6 / 12
0.12.0 6 / 12
0.11.0 6 / 12
0.10.14 6 / 12
0.10.13 6 / 12
0.10.12 6 / 12
0.10.11 6 / 12
0.10.10 6 / 12
0.10.9 6 / 12
0.10.8 6 / 12
0.10.7 6 / 12
0.10.6 6 / 12
0.10.5 6 / 12
0.10.4 6 / 12
0.10.3 6 / 12
0.10.2 6 / 12
0.10.1 6 / 12
0.10.0 6 / 12
0.9.4 6 / 12
0.9.3 6 / 12
0.9.2 6 / 12
0.9.1 6 / 12
0.9.0 6 / 12
0.8.3 6 / 13
0.8.2 6 / 13

v0.25.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.