@yummacss/intellisense
Shared Intellisense for Yumma CSS
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/sort-CSEfHWN3.mjs | AI (source-diff): Bundled build output (tsdown); readable identifiers and logic, not true obfuscation. | ai | |
| source-diff | obfuscated-file:dist/validate-DPs-m4mx.mjs | AI (source-diff): Bundled ESM output with long lines; no obfuscation patterns present — readable identifiers and CSS utility logic throughout. | ai | |
| source-diff | obfuscated-file:dist/sort-DmKnfVsQ.mjs | AI (source-diff): Bundler-generated chunk (tsdown/rollup hash suffix); content is readable minified JS importing own-scope deps, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/sort-D-IQdZlB.mjs | AI (source-diff): Bundler-generated chunk (tsdown/rollup hash suffix); content is readable minified JS from @yummacss/core, not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/sort-BhWv0MFR.mjs | AI (source-diff): Standard bundler (tsdown) minified output; content is readable CSS utility logic, not obfuscated malware. | ai | |
| phantom-deps | phantom-dep:tinycolor2 | AI (phantom-deps): tinycolor2 is a declared runtime dep; phantom-dep fires because it's used indirectly via bundled output, not a direct import. | ai | |
| phantom-deps | phantom-dep:@yummacss/core | AI (phantom-deps): Same-org monorepo dep; declared as runtime dependency, not directly imported in source — stable false positive. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 3.28.3 | 4 / 2 | |
| 3.28.2 | 4 / 2 | |
| 3.28.1 | 4 / 2 | |
| 3.27.0 | 1 / 3 | |
| 3.26.0 | 1 / 3 | |
| 3.25.0 | 1 / 3 | |
| 3.24.16 | 1 / 3 | |
| 3.24.15 | 1 / 3 | |
| 3.24.14 | 1 / 3 | |
| 3.24.13 | 1 / 3 | |
| 3.24.12 | 1 / 3 | |
| 3.24.11 | 1 / 3 | |
| 3.24.10 | 1 / 3 | |
| 3.24.9 | 1 / 3 | |
| 3.24.8 | 1 / 3 | |
| 3.24.7 | 1 / 3 | |
| 3.24.6 | 1 / 3 | |
| 3.24.5 | 1 / 3 | |
| 3.24.4 | 1 / 3 | |
| 3.24.3 | 1 / 3 | |
| 3.24.2 | 1 / 3 | |
| 3.24.1 | 1 / 3 | |
| 3.24.0 | 1 / 3 | |
| 3.23.0 | 1 / 3 | |
| 3.22.4 | 1 / 3 | |
| 3.22.3 | 1 / 3 | |
| 3.22.2 | 1 / 3 | |
| 3.22.1 | 1 / 3 | |
| 3.22.0 | 1 / 3 | |
| 3.21.2 | 1 / 3 | |
| 3.21.1 | 1 / 3 | |
| 3.21.0 | 1 / 3 | |
| 3.20.8 | 1 / 3 | |
| 3.20.7 | 1 / 3 | |
| 3.20.6 | 1 / 3 | |
| 3.20.5 | 1 / 3 | |
| 3.20.4 | 1 / 3 | |
| 3.20.3 | 1 / 3 | |
| 3.20.2 | 1 / 3 | |
| 3.20.1 | 1 / 3 | |
| 3.20.0 | 1 / 3 | |
| 3.19.0 | 2 / 2 | |
| 3.18.0 | 2 / 2 |
v3.28.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.28.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.28.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.27.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.26.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.25.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.24.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.22.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.22.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.20.3
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.19.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.