Home / npm

Is vue-types safe to install?

ASK DepWall stops this install and asks a human.

Checked 2026-09-20 against version 7.0.0, using the same engine the CLI runs. This is a record of one check at one moment — run the gate for the answer that applies to the version you are about to install.

What the registry says

Signals that fired

• warn attestation

  "[email protected]" has NO provenance attestation but recent prior versions were attested — matches the stolen-token account-takeover shape; verify the publish pipeline change is legitimate

  Relates to npm provenance attestations across this and prior releases.

What was checked

DepWall reads registry metadata and the package's own manifest before any of its code runs. On npm that means the name against a popularity dictionary and a curated hallucination feed, the tarball hash against OSV's malicious-release advisories, lifecycle scripts, publication age and adoption, provenance attestations across this and prior releases, and dependencies that resolve outside the registry.

It does not execute the package, and this page did not download its source. How verdicts are decided · what this cannot catch.

Check it yourself

npm i -g depwall && depwall init
depwall check vue-types

Once depwall init has run, the check happens on npm install itself — including for the transitive dependencies you never chose, which is where most of this actually arrives.