yup
Dead simple Object schema validation
19
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
monastic.panic
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:lodash-es | AI (phantom-deps): yup ships dual CJS/ESM builds; lodash-es is used in the ESM output. This is a stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@types/lodash | AI (phantom-deps): @types/lodash as a runtime dep is unusual but benign — used for TypeScript consumers. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): @babel/runtime is injected by Babel transforms at build time; not directly imported in source. Standard pattern for Babel-compiled packages. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is in gulpfile.js (dev build tooling only), not in runtime code shipped to consumers. Standard Gulp visitor-loading pattern; no risk to package users. | ai | |
| phantom-deps | phantom-dep:fn-name | AI (phantom-deps): fn-name is explicitly declared as a runtime dependency in package.json; this is a false positive from the phantom-deps analyzer. | ai |