All @pisell/private-materials versions
@pisell/private-materials @1.1.2111
pisell前端使用的私有物料
Maintainers
Dependencies (20)
| Package | Constraint | Registry Status |
|---|---|---|
| antd | 5.10.1 | No greenflagged match |
| dayjs | ^1.11.9 | auto_approved |
| ahooks | ^3.7.6 | auto_approved |
| classnames | ^2.3.2 | auto_approved |
| decimal.js | ^10.4.3 | auto_approved |
| @pisell/icon | 0.0.10 | No greenflagged match |
| @dnd-kit/core | ^6.0.8 | auto_approved |
| @pisell/utils | 1.0.68 | No greenflagged match |
| rc-virtual-list | ^3.11.3 | auto_approved |
| react-resizable | ^3.0.5 | auto_approved |
| @ant-design/icons | ^5.6.1 | auto_approved |
| @dnd-kit/sortable | ^7.0.2 | No greenflagged match |
| @pisell/materials | 1.0.1064 | No greenflagged match |
| @react-spring/web | ^9.6.1 | auto_approved |
| styled-components | ^6.0.0-rc.3 | auto_approved |
| @dnd-kit/modifiers | ^6.0.1 | No greenflagged match |
| @dnd-kit/utilities | ^3.2.1 | auto_approved |
| @use-gesture/react | ^10.3.1 | auto_approved |
| @pisell/date-picker | 1.0.141 | No greenflagged match |
| react-infinite-scroll-component | ^6.1.0 | No greenflagged match |
Dev Dependencies (37)
| Package | Constraint | Registry Status |
|---|---|---|
| jsdom | 22.1.0 | auto_approved |
| react | ^18.0.0 | auto_approved |
| father | ^4.1.6 | auto_approved |
| lodash | ^4.17.21 | auto_approved |
| vitest | 1.6.0 | No greenflagged match |
| webpack | ^4.27.1 | auto_approved |
| inquirer | ^6.5.1 | auto_approved |
| react-dom | ^18.0.0 | auto_approved |
| storybook | ^7.6.19 | auto_approved |
| @vitest/ui | 1.6.0 | auto_approved |
| css-loader | ^6.0.0 | auto_approved |
| url-loader | ^4.1.1 | auto_approved |
| less-loader | ^11.0.0 | auto_approved |
| sass-loader | 7.3.1 | No greenflagged match |
| @types/react | ^18.0.38 | auto_approved |
| style-loader | 2.0.0 | auto_approved |
| @svgr/webpack | ^5.5.0 | auto_approved |
| build-scripts | 1.0.1 | Not imported |
| postcss-loader | ^4.3.0 | auto_approved |
| @storybook/react | ^7.6.19 | auto_approved |
| @types/react-dom | ^18.0.0 | No greenflagged match |
| @storybook/blocks | ^7.6.19 | auto_approved |
| webpack-dev-server | ^4.0.0 | No greenflagged match |
| @alib/build-scripts | ^0.1.32 | Not imported |
| @alilc/lowcode-types | 1.1.7 | No greenflagged match |
| @alilc/lowcode-utils | 1.1.6 | No greenflagged match |
| @storybook/addon-links | ^7.6.19 | auto_approved |
| @testing-library/react | 12.1.5 | No greenflagged match |
| build-plugin-component | ^1.6.5 | Not imported |
| @alilc/build-plugin-alt | ^1.3.3 | Not imported |
| @storybook/react-webpack5 | ^7.6.19 | No greenflagged match |
| @testing-library/jest-dom | 5.16.5 | auto_approved |
| @storybook/addon-essentials | ^7.6.19 | No greenflagged match |
| @testing-library/user-event | 14.6.1 | auto_approved |
| @pisell/build-plugin-lowcode | ^1.0.13 | Not imported |
| @alilc/lowcode-react-renderer | ^1.1.7 | Not imported |
| @storybook/addon-interactions | ^7.6.19 | No greenflagged match |
Transitive Dependency Tree
Changes from v6.3.111
Dependency Changes
| Change | Package | Version |
|---|---|---|
| changed | @pisell/icon | 0.0.11 → 0.0.10 |
| changed | @pisell/utils | 3.0.5 → 1.0.68 |
| changed | @pisell/materials | 6.3.27 → 1.0.1064 |
| changed | @pisell/date-picker | 3.0.8 → 1.0.141 |
Script Changes
+ build:tsdownFile Changes
SAST Findings (6)
Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).
Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).
Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).
Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).
Declared in package.json dependencies but never imported in source code. Phantom dependencies may exist solely to execute install scripts or inject transitive malicious code. This was the exact attack vector in the axios compromise (plain-crypto-js).
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
Review Summary
Risk score: 100 (capped from 181). Findings: 5 high (+125), 5 medium (+50), 2 low (+6).
Published to npm: