father

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zoomdong07) on 2026-07-13, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed to zoomdong07, an account with 4062 rejected packages and only 824 approved. This is a persistent red flag for this package.) This version was published by a different npm account than previous versions on 2026-07-10. This could indicate a legitimate maintainer transition or an account compromise.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed to zoomdong07, an account with 4062 rejected packages and only 824 approved. This is a persistent red flag for this package.) This version was published by a different npm account than previous versions on 2026-07-08. This could indicate a legitimate maintainer transition or an account compromise.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed to zoomdong07, an account with 4062 rejected packages and only 824 approved. This is a persistent red flag for this package.) This version was published by a different npm account than previous versions on 2026-07-01. This could indicate a legitimate maintainer transition or an account compromise.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

[Always reject] Version constraint: 1.0.0.

[Always reject] This version was published by a different npm account than previous versions on 2025-11-25. This could indicate a legitimate maintainer transition or an account compromise.

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed to zoomdong07, an account with 4062 rejected packages and only 824 approved. This is a persistent red flag for this package.) This version was published by a different npm account than previous versions on 2022-02-08. This could indicate a legitimate maintainer transition or an account compromise.

child_process imported — can execute arbitrary system commands Source: ssh://[email protected]/umijs/father/blob/2cca6a2cbf3869ebe96e9f64ff89b2877e12a79a/lib/doc/docz.js#L10 8 | var assert = _interopRequireWildcard(require("assert")); 9 | > 10 | var _child_process = require("child_process"); 11 | 12 | var _path = require("path");

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed to zoomdong07, an account with 4062 rejected packages and only 824 approved. This is a persistent red flag for this package.) This version was published by a different npm account than previous versions on 2021-08-08. This could indicate a legitimate maintainer transition or an account compromise.

child_process imported — can execute arbitrary system commands Source: ssh://[email protected]/umijs/father/blob/fd6e4d0564f9e494f76e6dc70770f02fea87b284/lib/doc/docz.js#L10 8 | var assert = _interopRequireWildcard(require("assert")); 9 | > 10 | var _child_process = require("child_process"); 11 | 12 | var _path = require("path");

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Reject — re-review on republish] (prior reject: AI (provenance): Publisher changed to zoomdong07, an account with 4062 rejected packages and only 824 approved. This is a persistent red flag for this package.) This version was published by a different npm account than previous versions on 2019-07-15. This could indicate a legitimate maintainer transition or an account compromise.

child_process imported — can execute arbitrary system commands Source: ssh://[email protected]/umijs/father/blob/3281abe5d635c48103218c2bf4ef6d0db5197fc4/lib/doc/docz.js#L10 8 | var assert = _interopRequireWildcard(require("assert")); 9 | > 10 | var _child_process = require("child_process"); 11 | 12 | var _path = require("path");

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

child_process imported — can execute arbitrary system commands Source: ssh://[email protected]/umijs/father/blob/20f8734087f1ce2bedad422bd93d007973c635f8/lib/doc/doc.e2e.js#L5 3 | var _path = require("path"); 4 | > 5 | var _child_process = require("child_process"); 6 | 7 | var _puppeteer = _interopRequireDefault(require("puppeteer"));

child_process imported — can execute arbitrary system commands Source: ssh://[email protected]/umijs/father/blob/20f8734087f1ce2bedad422bd93d007973c635f8/lib/doc/docz.js#L10 8 | var assert = _interopRequireWildcard(require("assert")); 9 | > 10 | var _child_process = require("child_process"); 11 | 12 | var _path = require("path");

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version was published by a different npm account (sorrycc) than the most recent previously approved version (popomore) on 2019-06-19, but sorrycc is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.