← Home

@univerjs/ui

npm Repository Homepage
8
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

jikkaiwbfsamengshukeji

Keywords

univeruiworkbenchmenusreact

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:rc-util AI (phantom-deps): Likely used via bundled/re-exported UI components; common in Univer monorepo packages. ai
phantom-deps phantom-dep:@univerjs/icons AI (phantom-deps): Same-org dependency, likely re-exported in build output not scanned. ai
dependencies unvetted-dep:@wendellhu/redi AI (dependencies): Long-standing dependency in the univerjs ecosystem; stable across many approved versions. ai
phantom-deps phantom-dep:localforage AI (phantom-deps): localforage is a declared runtime dependency; phantom-dep heuristic misfires here. ai
typosquat typosquat.levenshtein:uuid AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to uuid is a false positive for this established monorepo package. ai
typosquat typosquat.levenshtein:yup AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to yup is a false positive. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to pg is a false positive. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to qs is a false positive. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped @univerjs/ui package; Levenshtein match to joi is a false positive. ai

Versions (showing 8 of 108)

Version Deps Published
0.1.8 5 / 20
0.1.7 5 / 20
0.1.6 5 / 20
0.1.5 5 / 20
0.1.4 4 / 19
0.1.3 4 / 19
0.1.2 4 / 18
0.1.1 4 / 18

v0.1.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.