vue-demi
<p align="center"> <img src="https://github.com/vueuse/vue-demi/blob/main/assets/banner.png?raw=true" width="600"/> <br> <a href='https://www.npmjs.com/package/vue-demi'><img src='https://img.shields.io/npm/v/vue-demi?color=42b883' alt='npm'></a> </p>
37
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
posvaantfu
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): posva (Eduardo San Martin Morote) is a Vue.js core team member and legitimate co-maintainer of vue-demi alongside antfu. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): posva is a well-known Vue.js core team member added as a legitimate co-maintainer. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): vue-demi's postinstall uses execSync to detect Vue version and configure compatibility shims — a documented, stable design pattern for this package across all versions. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): vue-demi's postinstall is its core Vue 2/3 compatibility-switching mechanism, documented and stable across all 88 versions. Not malicious. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in loadModule() is used to probe for installed Vue peer dependencies (vue, @vue/composition-api). Standard peer-dep detection pattern, not arbitrary code loading. | ai | |
| bogus-package | bogus-package | AI (bogus-package): antfu (Anthony Fu) is a Vue core team member with a well-established open-source track record. The spam flag is a false positive for this publisher. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 0.14.6 | 0 / 0 | |
| 0.14.5 | 0 / 0 | |
| 0.14.3 | 0 / 0 | |
| 0.14.2 | 0 / 0 | |
| 0.14.1 | 0 / 0 | |
| 0.13.10 | 0 / 0 | |
| 0.13.4 | 0 / 0 | |
| 0.13.3 | 0 / 0 | |
| 0.13.0 | 0 / 0 | |
| 0.12.4 | 0 / 0 | |
| 0.12.0 | 0 / 0 | |
| 0.11.4 | 0 / 0 | |
| 0.11.2 | 0 / 0 | |
| 0.11.1 | 0 / 0 | |
| 0.10.1 | 0 / 0 | |
| 0.7.4 | 0 / 0 | |
| 0.6.1 | 0 / 3 | |
| 0.5.3 | 0 / 0 | |
| 0.5.0 | 0 / 0 | |
| 0.4.5 | 0 / 0 | |
| 0.4.3 | 0 / 0 | |
| 0.4.1 | 0 / 0 | |
| 0.3.1 | 0 / 0 | |
| 0.3.0 | 0 / 1 | |
| 0.2.0 | 1 / 1 | |
| 0.1.11 | 0 / 2 | |
| 0.1.8 | 0 / 2 | |
| 0.1.7 | 0 / 2 | |
| 0.1.6 | 0 / 2 | |
| 0.1.3 | 0 / 2 | |
| 0.1.0 | 0 / 2 | |
| 0.0.7 | 0 / 2 | |
| 0.0.6 | 0 / 2 | |
| 0.0.5 | 0 / 2 | |
| 0.0.4 | 0 / 2 | |
| 0.0.2 | 0 / 2 | |
| 0.0.1 | 0 / 2 |