@yummacss/intellisense
Shared Intellisense for Yumma CSS
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/sort-DmKnfVsQ.mjs | AI (source-diff): Bundler-generated chunk (tsdown/rollup hash suffix); content is readable minified JS importing own-scope deps, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/sort-D-IQdZlB.mjs | AI (source-diff): Bundler-generated chunk (tsdown/rollup hash suffix); content is readable minified JS from @yummacss/core, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/sort-BhWv0MFR.mjs | AI (source-diff): Standard bundler (tsdown) minified output; content is readable CSS utility logic, not obfuscated malware. | ai | |
| phantom-deps | phantom-dep:tinycolor2 | AI (phantom-deps): tinycolor2 is a declared runtime dep; phantom-dep fires because it's used indirectly via bundled output, not a direct import. | ai | |
| phantom-deps | phantom-dep:@yummacss/core | AI (phantom-deps): Same-org monorepo dep; declared as runtime dependency, not directly imported in source — stable false positive. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 3.24.16 | 1 / 3 | |
| 3.24.15 | 1 / 3 | |
| 3.24.14 | 1 / 3 | |
| 3.24.13 | 1 / 3 | |
| 3.24.12 | 1 / 3 | |
| 3.24.11 | 1 / 3 | |
| 3.24.10 | 1 / 3 | |
| 3.24.9 | 1 / 3 | |
| 3.24.8 | 1 / 3 | |
| 3.24.7 | 1 / 3 | |
| 3.24.5 | 1 / 3 | |
| 3.24.4 | 1 / 3 | |
| 3.24.1 | 1 / 3 | |
| 3.24.0 | 1 / 3 | |
| 3.23.0 | 1 / 3 | |
| 3.22.3 | 1 / 3 | |
| 3.22.1 | 1 / 3 | |
| 3.22.0 | 1 / 3 | |
| 3.21.2 | 1 / 3 | |
| 3.21.1 | 1 / 3 | |
| 3.21.0 | 1 / 3 | |
| 3.20.8 | 1 / 3 | |
| 3.20.7 | 1 / 3 | |
| 3.20.6 | 1 / 3 | |
| 3.20.5 | 1 / 3 | |
| 3.20.4 | 1 / 3 | |
| 3.20.2 | 1 / 3 | |
| 3.20.1 | 1 / 3 | |
| 3.20.0 | 1 / 3 | |
| 3.18.0 | 2 / 2 |
v3.24.16
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.15
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.14
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.13
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.23.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.22.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.22.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.22.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.21.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.18.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.