@vue/compiler-sfc
@vue/compiler-sfc
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist/compiler-sfc.esm-browser.js | AI (source-diff): Base64-encoded HTML entity decode tree from the 'entities' library — standard for an HTML/SFC parser. | ai | |
| provenance | publisher-changed | AI (provenance): Vue.js moved from yyx990803 to GitHub Actions CI/CD publishing with SLSA provenance; legitimate automation transition. | ai | |
| source-diff | encoded-string-file:dist/compiler-sfc.cjs.js | AI (source-diff): Base64-encoded WASM module for xxhash64 hashing — standard bundled dependency in compiler tooling. | ai | |
| dependencies | unvetted-dep:@vue/compiler-dom | AI (dependencies): @vue/compiler-dom is a sibling package in the official vuejs/core monorepo; always a legitimate dependency for @vue/compiler-sfc. | ai | |
| dependencies | unvetted-dep:@babel/parser | AI (dependencies): @babel/parser is a well-known, widely-used parser dependency appropriate for a Vue SFC compiler; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:@vue/compiler-ssr | AI (dependencies): @vue/compiler-ssr is a sibling package in the official vuejs/core monorepo; always a legitimate dependency for @vue/compiler-sfc. | ai | |
| dependencies | unvetted-dep:@vue/compiler-core | AI (dependencies): @vue/compiler-core is a first-party Vue.js package from the same monorepo; not a third-party risk. | ai | |
| dependencies | unvetted-dep:source-map-js | AI (dependencies): source-map-js is a well-known, widely-used fork of Mozilla's source-map library; legitimate dependency for a compiler package. | ai | |
| phantom-deps | phantom-dep:hash-sum | AI (phantom-deps): hash-sum is explicitly declared as a runtime dependency in package.json (^2.0.0); phantom-dep finding is a false positive for this package. | ai |
Versions (showing 20 of 20)
| Version | Deps | Published |
|---|---|---|
| 3.5.32 | 9 / 10 | |
| 3.5.28 | 9 / 10 | |
| 3.4.31 | 9 / 10 | |
| 3.4.30 | 9 / 10 | |
| 2.7.16 | 4 / 17 | |
| 2.7.15 | 3 / 17 | |
| 2.7.14 | 3 / 17 | |
| 2.7.13 | 3 / 17 | |
| 2.7.12 | 3 / 17 | |
| 2.7.11 | 3 / 17 | |
| 2.7.10 | 3 / 17 | |
| 2.7.9 | 3 / 17 | |
| 2.7.8 | 3 / 17 | |
| 2.7.7 | 3 / 18 | |
| 2.7.6 | 3 / 18 | |
| 2.7.5 | 3 / 18 | |
| 2.7.4 | 3 / 18 | |
| 2.7.3 | 3 / 18 | |
| 2.7.2 | 3 / 18 | |
| 2.7.1 | 3 / 18 |
v3.5.32
4 findingsThis version was published by a different npm account than previous versions on 2026-04-03. This could indicate a legitimate maintainer transition or an account compromise.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.5.28
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-02-09. This could indicate a legitimate maintainer transition or an account compromise.
v3.4.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.