@wzyjs/uis
description
17
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
wzy1993
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@ant-design/pro-form | AI (phantom-deps): Pro-form is a peer/transitive dep used via config re-exports; stable false positive for this UI library. | ai | |
| phantom-deps | phantom-dep:@ant-design/pro-provider | AI (phantom-deps): Pro-provider is a peer/transitive dep used via config re-exports; stable false positive for this UI library. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): Pinned to ^4.7.8 which is the patched version; no known unpatched CVEs in this range. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Growth explained by addition of multiple legitimate UI component modules (xyflow, pro-card, pro-form, dnd, etc.). | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase correlates directly with 7 new runtime deps and their corresponding component source files. | ai | |
| typosquat | typosquat.levenshtein:uuid | AI (typosquat): Scoped UI component library @wzyjs/uis; not a typosquat of uuid. | ai | |
| phantom-deps | phantom-dep:rehype-starry-night | AI (phantom-deps): Declared as runtime dep for consumers; config-file-only reference is expected for a component library. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): Scoped UI component library @wzyjs/uis; not a typosquat of qs. | ai | |
| phantom-deps | phantom-dep:ali-oss | AI (phantom-deps): Declared as runtime dep for consumers; config-file-only reference is expected for a component library. | ai | |
| phantom-deps | phantom-dep:echarts | AI (phantom-deps): Declared as runtime dep for consumers; config-file-only reference is expected for a component library. | ai | |
| phantom-deps | phantom-dep:remark-toc | AI (phantom-deps): Declared as runtime dep for consumers; config-file-only reference is expected for a component library. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 0.3.41 | 26 / 8 | |
| 0.3.39 | 26 / 8 | |
| 0.3.38 | 26 / 7 | |
| 0.3.36 | 26 / 7 | |
| 0.3.31 | 25 / 7 | |
| 0.3.30 | 25 / 3 | |
| 0.3.29 | 23 / 2 | |
| 0.3.28 | 23 / 2 | |
| 0.3.26 | 22 / 0 | |
| 0.3.25 | 22 / 0 | |
| 0.3.23 | 22 / 0 | |
| 0.3.22 | 22 / 0 | |
| 0.3.20 | 22 / 0 | |
| 0.3.18 | 22 / 0 | |
| 0.3.10 | 22 / 0 | |
| 0.3.9 | 22 / 0 | |
| 0.3.8 | 22 / 0 |
v0.3.41
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.39
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.38
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.