@arach/dewey — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

arach

Keywords

documentationdocsclireactcomponentsagentsllmmarkdown

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	source-size-tripled	AI (source-diff): Size growth is consistent with expanded CSS theming (8 color themes) and new React component files in a documentation toolkit; not indicative of injected payload.	ai	2026/04/27
source-diff	large-new-source-files	AI (source-diff): 21 new files align with the expanded CSS color themes and component additions visible in the exports map; organic growth for this package.	ai	2026/04/27
publish-pattern	new-deps-added	AI (publish-pattern): class-variance-authority is a well-known React component variant utility; addition is consistent with the package's styling system refactor replacing clsx/tailwind-merge.	ai	2026/04/27
phantom-deps	phantom-dep:react-markdown	AI (phantom-deps): Declared dependency used via config; common pattern in markdown/docs tools.	ai	2026/04/25
phantom-deps	phantom-dep:remark-gfm	AI (phantom-deps): Declared dependency used via config; common pattern in markdown/docs tools.	ai	2026/04/25
phantom-deps	phantom-dep:class-variance-authority	AI (phantom-deps): Declared dependency used via config; common pattern in markdown/docs tools.	ai	2026/04/25
phantom-deps	phantom-dep:rehype-slug	AI (phantom-deps): Declared dependency used via config; common pattern in markdown/docs tools.	ai	2026/04/25
phantom-deps	phantom-dep:highlight.js	AI (phantom-deps): Declared dependency used via config; common pattern in markdown/docs tools.	ai	2026/04/25