fumadocs-ui @16.8.0
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
35
Risk Score
—
License
No
Install Scripts
21
Dependencies
15
Dev Dependencies
110.9 KB
Package Size
Published
Maintainers
sonmoosans
Keywords
DocsFumadocs
Dependencies (21)
| Package | Constraint | Registry Status |
|---|---|---|
| shiki | ^4.0.2 | auto_approved |
| motion | ^12.38.0 | auto_approved |
| rehype-raw | ^7.0.0 | auto_approved |
| next-themes | ^0.4.6 | auto_approved |
| lucide-react | ^1.8.0 | auto_approved |
| tailwind-merge | ^3.5.0 | auto_approved |
| unist-util-visit | ^5.1.0 | auto_approved |
| @fumadocs/tailwind | 0.0.5 | auto_approved |
| react-remove-scroll | ^2.7.2 | auto_approved |
| @radix-ui/react-slot | ^1.2.4 | auto_approved |
| @radix-ui/react-tabs | ^1.1.13 | rejected |
| @radix-ui/react-dialog | ^1.1.15 | rejected |
| @radix-ui/react-popover | ^1.1.15 | auto_approved |
| @radix-ui/react-presence | ^1.1.5 | auto_approved |
| class-variance-authority | ^0.7.1 | auto_approved |
| @radix-ui/react-accordion | ^1.2.12 | auto_approved |
| @radix-ui/react-direction | ^1.1.1 | auto_approved |
| scroll-into-view-if-needed | ^3.1.0 | auto_approved |
| @radix-ui/react-collapsible | ^1.1.12 | auto_approved |
| @radix-ui/react-scroll-area | ^1.2.10 | auto_approved |
| @radix-ui/react-navigation-menu | ^1.2.14 | auto_approved |
Dev Dependencies (15)
| Package | Constraint | Registry Status |
|---|---|---|
| tsdown | 0.21.8 | auto_approved |
| unified | ^11.0.5 | auto_approved |
| fuma-cli | ^0.0.5 | auto_approved |
| tsconfig | 0.0.0 | pending |
| @types/mdx | ^2.0.13 | needs_review |
| @tsdown/css | ^0.21.8 | auto_approved |
| @types/hast | ^3.0.4 | auto_approved |
| @types/node | ^25.6.0 | auto_approved |
| tailwindcss | ^4.2.2 | auto_approved |
| @types/react | ^19.2.14 | auto_approved |
| @fumadocs/cli | 1.3.8 | auto_approved |
| fumadocs-core | 16.8.0 | auto_approved |
| @tailwindcss/cli | ^4.2.2 | auto_approved |
| @types/react-dom | ^19.2.3 | auto_approved |
| react-medium-image-zoom | ^5.4.3 | auto_approved |
Transitive Dependency Tree
85 transitive deps
max depth 6
├─
@fumadocs/tailwind
0.0.5
→ 0.0.5
├─
@radix-ui/react-accordion
^1.2.12
→ 1.2.12
├─
@radix-ui/react-collapsible
^1.1.12
→ 1.1.12
├─
@radix-ui/react-dialog
^1.1.15
├─
@radix-ui/react-direction
^1.1.1
→ 1.1.1
├─
@radix-ui/react-navigation-menu
^1.2.14
→ 1.2.14
├─
@radix-ui/react-popover
^1.1.15
→ 1.1.15
├─
@radix-ui/react-presence
^1.1.5
→ 1.1.5
├─
@radix-ui/react-scroll-area
^1.2.10
→ 1.2.10
├─
@radix-ui/react-slot
^1.2.4
→ 1.2.4
├─
@radix-ui/react-tabs
^1.1.13
├─
class-variance-authority
^0.7.1
→ 0.7.1
├─
lucide-react
^1.8.0
→ 1.14.0
├─
motion
^12.38.0
→ 12.38.0
├─
next-themes
^0.4.6
→ 0.4.6
├─
react-remove-scroll
^2.7.2
→ 2.7.2
├─
rehype-raw
^7.0.0
→ 7.0.0
├─
scroll-into-view-if-needed
^3.1.0
→ 3.1.0
├─
shiki
^4.0.2
→ 4.0.2
├─
tailwind-merge
^3.5.0
→ 3.5.0
├─
unist-util-visit
^5.1.0
→ 5.1.0
├─
@radix-ui/number
1.1.1
→ 1.1.1
├─
@radix-ui/primitive
1.1.3
→ 1.1.3
├─
@radix-ui/react-collapsible
1.1.12
→ 1.1.12
├─
@radix-ui/react-collection
1.1.7
├─
@radix-ui/react-compose-refs
1.1.2
→ 1.1.2
├─
@radix-ui/react-context
1.1.2
→ 1.1.2
├─
@radix-ui/react-direction
1.1.1
→ 1.1.1
├─
@radix-ui/react-dismissable-layer
1.1.11
→ 1.1.11
├─
@radix-ui/react-focus-guards
1.1.3
→ 1.1.3
├─
@radix-ui/react-focus-scope
1.1.7
→ 1.1.7
├─
@radix-ui/react-id
1.1.1
→ 1.1.1
├─
@radix-ui/react-popper
1.2.8
├─
@radix-ui/react-portal
1.1.9
→ 1.1.9
├─
@radix-ui/react-presence
1.1.5
→ 1.1.5
├─
@radix-ui/react-primitive
2.1.3
→ 2.1.3
├─
@radix-ui/react-slot
1.2.3
→ 1.2.3
├─
@radix-ui/react-use-callback-ref
1.1.1
→ 1.1.1
├─
@radix-ui/react-use-controllable-state
1.2.2
├─
@radix-ui/react-use-layout-effect
1.1.1
→ 1.1.1
├─
@radix-ui/react-use-previous
1.1.1
→ 1.1.1
├─
@radix-ui/react-visually-hidden
1.2.3
├─
@shikijs/core
4.0.2
→ 4.0.2
├─
@shikijs/engine-javascript
4.0.2
→ 4.0.2
├─
@shikijs/engine-oniguruma
4.0.2
→ 4.0.2
├─
@shikijs/langs
4.0.2
→ 4.0.2
├─
@shikijs/themes
4.0.2
→ 4.0.2
├─
@shikijs/types
4.0.2
→ 4.0.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/unist
^3.0.0
→ 3.0.3
├─
aria-hidden
^1.2.4
→ 1.2.6
├─
clsx
^2.1.1
→ 2.1.1
├─
compute-scroll-into-view
^3.0.2
├─
framer-motion
^12.38.0
→ 12.38.0
├─
hast-util-raw
^9.0.0
├─
react-remove-scroll
^2.6.3
→ 2.7.2
├─
react-remove-scroll-bar
^2.3.7
→ 2.3.8
├─
react-style-singleton
^2.2.3
→ 2.2.3
├─
tslib
^2.1.0
→ 2.8.1
├─
tslib
^2.4.0
→ 2.8.1
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
use-callback-ref
^1.3.3
→ 1.3.3
├─
use-sidecar
^1.1.3
→ 1.1.3
├─
vfile
^6.0.0
→ 6.0.3
├─
@radix-ui/primitive
1.1.3
→ 1.1.3
├─
@radix-ui/react-compose-refs
1.1.2
→ 1.1.2
├─
@radix-ui/react-context
1.1.2
→ 1.1.2
├─
@radix-ui/react-id
1.1.1
→ 1.1.1
├─
@radix-ui/react-presence
1.1.5
→ 1.1.5
├─
@radix-ui/react-primitive
2.1.3
→ 2.1.3
├─
@radix-ui/react-slot
1.2.3
→ 1.2.3
├─
@radix-ui/react-use-callback-ref
1.1.1
→ 1.1.1
├─
@radix-ui/react-use-controllable-state
1.2.2
├─
@radix-ui/react-use-escape-keydown
1.1.1
→ 1.1.1
├─
@radix-ui/react-use-layout-effect
1.1.1
→ 1.1.1
├─
@shikijs/primitive
4.0.2
→ 4.0.2
├─
@shikijs/types
4.0.2
→ 4.0.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/unist
^3.0.0
→ 3.0.3
├─
@types/unist
*
├─
detect-node-es
^1.1.0
→ 1.1.0
├─
get-nonce
^1.0.0
→ 1.0.1
├─
hast-util-to-html
^9.0.5
→ 9.0.5
├─
motion-dom
^12.38.0
→ 12.38.0
├─
motion-utils
^12.36.0
→ 12.36.0
├─
oniguruma-to-es
^4.3.4
→ 4.3.6
├─
react-remove-scroll-bar
^2.3.7
→ 2.3.8
├─
react-style-singleton
^2.2.2
→ 2.2.3
├─
react-style-singleton
^2.2.3
→ 2.2.3
├─
tslib
^2.0.0
→ 2.8.1
├─
tslib
^2.1.0
→ 2.8.1
├─
tslib
^2.4.0
→ 2.8.1
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
use-callback-ref
^1.3.3
→ 1.3.3
├─
use-sidecar
^1.1.3
→ 1.1.3
├─
vfile-message
^4.0.0
→ 4.0.3
├─
@radix-ui/react-compose-refs
1.1.2
→ 1.1.2
├─
@radix-ui/react-slot
1.2.3
→ 1.2.3
├─
@radix-ui/react-use-callback-ref
1.1.1
→ 1.1.1
├─
@radix-ui/react-use-layout-effect
1.1.1
→ 1.1.1
├─
@shikijs/types
4.0.2
→ 4.0.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/unist
^3.0.0
→ 3.0.3
├─
@types/unist
*
├─
ccount
^2.0.0
→ 2.0.1
├─
comma-separated-tokens
^2.0.0
→ 2.0.3
├─
detect-node-es
^1.1.0
→ 1.1.0
├─
get-nonce
^1.0.0
→ 1.0.1
├─
hast-util-whitespace
^3.0.0
→ 3.0.0
├─
html-void-elements
^3.0.0
→ 3.0.0
├─
mdast-util-to-hast
^13.0.0
├─
motion-utils
^12.36.0
→ 12.36.0
├─
oniguruma-parser
^0.12.2
├─
property-information
^7.0.0
→ 7.1.0
├─
react-style-singleton
^2.2.2
→ 2.2.3
├─
regex
^6.1.0
→ 6.1.0
├─
regex-recursion
^6.0.2
→ 6.0.2
├─
space-separated-tokens
^2.0.0
→ 2.0.2
├─
stringify-entities
^4.0.0
→ 4.0.4
├─
tslib
^2.0.0
→ 2.8.1
├─
unist-util-stringify-position
^4.0.0
├─
zwitch
^2.0.4
→ 2.0.4
├─
@radix-ui/react-compose-refs
1.1.2
→ 1.1.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/unist
*
├─
character-entities-html4
^2.0.0
├─
character-entities-legacy
^3.0.0
├─
get-nonce
^1.0.0
→ 1.0.1
├─
regex-utilities
^2.3.0
├─
tslib
^2.0.0
→ 2.8.1
├─
@types/unist
*
Changes from v16.7.16
No metadata changes detected.
File Changes
0 added
0 removed
1 modified
size delta: -.0 KB
Risk Dispositions (2 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
regressed-provenance |
provenance | reject | AI | AI (provenance): Provenance regression is a strong supply-chain compromise indicator; should block until CI/CD publishing is restored. | |
publisher-changed |
provenance | reject | AI | AI (provenance): Publisher changed from GitHub Actions to a human account; combined with provenance regression this is a disqualifying signal. |
SAST Findings (2)
HIGH
Provenance attestation missing — previous versions had it
provenance
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
HIGH
Publisher changed: GitHub Actions → sonmoosans (on 2026-04-19)
provenance
This version was published by a different npm account than previous versions on 2026-04-19. This could indicate a legitimate maintainer transition or an account compromise.
Review Summary
Risk score: 35. Findings: 1 high (+25), 1 medium (+10), 4 info (+0).
Published to npm: