← Home

@unocss/runtime

npm Repository Homepage
41
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

antfuunocss-botzyyv

Keywords

unocsscss-in-js

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-bulk-read AI (semgrep): Fires in minified build output of a CSS-in-JS config library; not a credential-theft risk. ai
phantom-deps phantom-dep:@unocss/preset-attributify AI (phantom-deps): Same-org sibling explicitly listed as a runtime dependency in package.json; stable false positive. ai

Versions (showing 41 of 41)

Version Deps Published
66.7.5 4 / 0
66.7.4 4 / 0
66.7.3 4 / 0
66.7.2 4 / 0
66.7.0 4 / 1
66.6.8 4 / 1
66.6.7 4 / 1
66.6.6 4 / 1
66.6.5 4 / 1
66.6.4 4 / 1
66.6.2 4 / 1
66.6.1 4 / 1
66.6.0 4 / 1
66.5.12 4 / 1
66.5.11 4 / 1
66.5.10 3 / 0
66.5.9 3 / 0
66.5.7 3 / 0
66.5.6 3 / 0
66.5.5 3 / 0
66.5.4 3 / 0
66.5.3 3 / 0
66.5.2 3 / 0
66.5.1 3 / 0
66.5.0 3 / 0
66.4.2 3 / 0
66.4.1 3 / 0
66.4.0 3 / 0
66.3.3 3 / 0
66.3.2 3 / 0
66.3.1 3 / 0
66.2.3 3 / 0
66.2.2 3 / 0
66.2.1 3 / 0
66.2.0 3 / 0
66.1.4 3 / 0
66.1.3 3 / 0
66.1.2 3 / 0
66.1.1 3 / 0
66.1.0 3 / 0
66.0.0 3 / 0

v66.7.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v66.7.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v66.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.