@ckeditor/ckeditor5-export-pdf

Export to PDF feature for CKEditor 5.

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ckeditor

Keywords

ckeditorckeditor5ckeditor 5ckeditor5-featureckeditor5-pluginWYSIWYGWYSIWYMtextrich-textrichtextckeditoreditoreditinghtmlcontentEditablePDFprint PDFsave PDFconvert to PDFexport PDFexport to PDFPDF converterHTML to PDF

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Large file count is expected for a full CKEditor plugin release with dist/build/src artifacts. Stable pattern for this package.	ai	2026/04/26
source-diff	obfuscated-file:build/export-pdf.js	AI (source-diff): CKSource intentionally obfuscates premium plugin code for IP protection; package.json declares 'obfuscated: true'. This is stable across all versions of this package.	ai	2026/04/26
source-diff	obfuscated-file:src/exportpdfcommand.js	AI (source-diff): CKSource intentionally obfuscates premium plugin source files; declared in package.json and consistent with their commercial licensing model.	ai	2026/04/26
source-diff	obfuscated-file:src/exportpdfui.js	AI (source-diff): CKSource intentionally obfuscates premium plugin source files; declared in package.json and consistent with their commercial licensing model.	ai	2026/04/26
semgrep	semgrep:obfuscation-while-true	AI (semgrep): Obfuscation is intentional and declared by CKSource for IP protection of this commercial plugin. Stable for all versions.	ai	2026/04/26
semgrep	semgrep:obfuscation-hex-functions	AI (semgrep): Hex-prefixed function names are from CKSource's deliberate obfuscation of proprietary code; declared in package.json. Stable for all versions.	ai	2026/04/26
phantom-deps	phantom-dep:@ckeditor/ckeditor5-ui	AI (phantom-deps): Same-org CKEditor dependency; phantom detection is a false positive for this tightly coupled plugin ecosystem.	ai	2026/04/26
phantom-deps	phantom-dep:@ckeditor/ckeditor5-core	AI (phantom-deps): Same-org CKEditor dependency; phantom detection is a false positive for this tightly coupled plugin ecosystem.	ai	2026/04/26
dependencies	unvetted-dep:@ckeditor/ckeditor5-core	AI (dependencies): First-party @ckeditor monorepo dependency, always released in lockstep with this package. Not an independent third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-utils	AI (dependencies): First-party @ckeditor monorepo dependency, always released in lockstep with this package. Not an independent third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-merge-fields	AI (dependencies): First-party @ckeditor monorepo dependency, always released in lockstep with this package. Not an independent third-party risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-cloud-services	AI (dependencies): First-party @ckeditor monorepo dependency, always released in lockstep with this package. Not an independent third-party risk.	ai	2026/04/25
phantom-deps	phantom-dep:@ckeditor/ckeditor5-icons	AI (phantom-deps): Same-org @ckeditor package; phantom dep pattern is expected in CKEditor 5 plugin ecosystem for re-exports and indirect usage.	ai	2026/04/25
phantom-deps	phantom-dep:@ckeditor/ckeditor5-merge-fields	AI (phantom-deps): Same-org @ckeditor package; phantom dep pattern is expected in CKEditor 5 plugin ecosystem for re-exports and indirect usage.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-ui	AI (dependencies): First-party @ckeditor monorepo dependency, always released in lockstep with this package. Not an independent third-party risk.	ai	2026/04/25

Versions (showing 15 of 15)

Version	Deps	Published
48.2.0	6 / 0	2026-06-02
48.1.1	6 / 0	2026-05-18
48.1.0	6 / 0	2026-05-13
48.0.1	6 / 0	2026-04-22
48.0.0	6 / 0	2026-03-31
47.7.2	7 / 0	2026-05-18
47.7.1	7 / 0	2026-04-23
47.7.0	7 / 0	2026-04-16
47.6.2	7 / 0	2026-04-08
47.6.1	7 / 0	2026-03-11
47.6.0	7 / 0	2026-03-04
47.5.0	7 / 0	2026-02-11
47.4.0	7 / 0	2026-01-14
47.3.0	7 / 0	2025-12-03
47.2.0	7 / 0	2025-11-05

v48.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v48.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v48.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v48.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v48.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.7.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.7.1

16 findings

HIGH New obfuscated file: build/export-pdf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: src/exportpdfcommand.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: src/exportpdfui.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH obfuscation-while-true: src/exportpdf.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x39b5b3=_0xac2d;(function(_0x4c5fd6,_0x1e4bb5){const _0x2c0969=_0xac2d,_0x1eb28c=_0x4c5fd6();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdf.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x39b5b3=_0xac2d;(function(_0x4c5fd6,_0x1e4bb5){const _0x2c0969=_0xac2d,_0x1eb28c=_0x4c5fd6();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdf.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x39b5b3=_0xac2d;(function(_0x4c5fd6,_0x1e4bb5){const _0x2c0969=_0xac2d,_0x1eb28c=_0x4c5fd6();while(!![]){try{con

HIGH obfuscation-while-true: src/exportpdfcommand.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x843df1=_0x1503;(function(_0x3ea4e0,_0x2598de){const _0x16cddf=_0x1503,_0x471eb3=_0x3ea4e0();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x843df1=_0x1503;(function(_0x3ea4e0,_0x2598de){const _0x16cddf=_0x1503,_0x471eb3=_0x3ea4e0();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x843df1=_0x1503;(function(_0x3ea4e0,_0x2598de){const _0x16cddf=_0x1503,_0x471eb3=_0x3ea4e0();while(!![]){try{con

HIGH obfuscation-while-true: src/exportpdfui.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x37dac8=_0x45cc;(function(_0x12d3d5,_0x28298b){const _0x1044d4=_0x45cc,_0x1e5637=_0x12d3d5();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x37dac8=_0x45cc;(function(_0x12d3d5,_0x28298b){const _0x1044d4=_0x45cc,_0x1e5637=_0x12d3d5();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x37dac8=_0x45cc;(function(_0x12d3d5,_0x28298b){const _0x1044d4=_0x45cc,_0x1e5637=_0x12d3d5();while(!![]){try{con

HIGH obfuscation-while-true: src/index.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x1d8d16,_0x2f1c5b){var _0x47e0ad=_0x7015,_0x5b1267=_0x1d8d16();while(!![]){try{var _0x1a1632=parseInt(_0x47e

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x1d8d16,_0x2f1c5b){var _0x47e0ad=_0x7015,_0x5b1267=_0x1d8d16();while(!![]){try{var _0x1a1632=parseInt(_0x47e

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x1d8d16,_0x2f1c5b){var _0x47e0ad=_0x7015,_0x5b1267=_0x1d8d16();while(!![]){try{var _0x1a1632=parseInt(_0x47e

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.7.0

16 findings

HIGH New obfuscated file: build/export-pdf.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: src/exportpdfcommand.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: src/exportpdfui.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH obfuscation-while-true: src/exportpdf.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x5bf491=_0x8762;(function(_0x52b26d,_0x3a326c){const _0x33b984=_0x8762,_0x27ff5f=_0x52b26d();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdf.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x5bf491=_0x8762;(function(_0x52b26d,_0x3a326c){const _0x33b984=_0x8762,_0x27ff5f=_0x52b26d();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdf.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x5bf491=_0x8762;(function(_0x52b26d,_0x3a326c){const _0x33b984=_0x8762,_0x27ff5f=_0x52b26d();while(!![]){try{con

HIGH obfuscation-while-true: src/exportpdfcommand.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x303031=_0x5dc7;(function(_0x6cd168,_0x4d9aa2){const _0x4fde6f=_0x5dc7,_0x40110b=_0x6cd168();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x303031=_0x5dc7;(function(_0x6cd168,_0x4d9aa2){const _0x4fde6f=_0x5dc7,_0x40110b=_0x6cd168();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x303031=_0x5dc7;(function(_0x6cd168,_0x4d9aa2){const _0x4fde6f=_0x5dc7,_0x40110b=_0x6cd168();while(!![]){try{con

HIGH obfuscation-while-true: src/exportpdfui.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x1f9ca6=_0x5a90;(function(_0x3a98e4,_0x148243){const _0x3ba394=_0x5a90,_0x5f133e=_0x3a98e4();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x1f9ca6=_0x5a90;(function(_0x3a98e4,_0x148243){const _0x3ba394=_0x5a90,_0x5f133e=_0x3a98e4();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x1f9ca6=_0x5a90;(function(_0x3a98e4,_0x148243){const _0x3ba394=_0x5a90,_0x5f133e=_0x3a98e4();while(!![]){try{con

HIGH obfuscation-while-true: src/index.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x1667be,_0x1add39){var _0x5a87ba=_0x47f3,_0x335864=_0x1667be();while(!![]){try{var _0x870b44=-parseInt(_0x5a

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x1667be,_0x1add39){var _0x5a87ba=_0x47f3,_0x335864=_0x1667be();while(!![]){try{var _0x870b44=-parseInt(_0x5a

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x1667be,_0x1add39){var _0x5a87ba=_0x47f3,_0x335864=_0x1667be();while(!![]){try{var _0x870b44=-parseInt(_0x5a

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.6.2

13 findings

HIGH obfuscation-while-true: src/exportpdf.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x545974=_0x3f62;(function(_0x78415a,_0x2f2b2e){const _0x5baf7c=_0x3f62,_0x3c2c4a=_0x78415a();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdf.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x545974=_0x3f62;(function(_0x78415a,_0x2f2b2e){const _0x5baf7c=_0x3f62,_0x3c2c4a=_0x78415a();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdf.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x545974=_0x3f62;(function(_0x78415a,_0x2f2b2e){const _0x5baf7c=_0x3f62,_0x3c2c4a=_0x78415a();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | function _0xf3fb(_0xaf4d93,_0x37010f){const _0x3353ff=_0x3353();return _0xf3fb=function(_0xf3fb33,_0xb30c15){_0xf3fb33=_

HIGH obfuscation-while-true: src/exportpdfcommand.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | function _0xf3fb(_0xaf4d93,_0x37010f){const _0x3353ff=_0x3353();return _0xf3fb=function(_0xf3fb33,_0xb30c15){_0xf3fb33=_

HIGH obfuscation-hex-functions: src/exportpdfcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | function _0xf3fb(_0xaf4d93,_0x37010f){const _0x3353ff=_0x3353();return _0xf3fb=function(_0xf3fb33,_0xb30c15){_0xf3fb33=_

HIGH obfuscation-while-true: src/exportpdfui.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x4add62=_0x3e2b;(function(_0x58035e,_0x22fce0){const _0x16dcc2=_0x3e2b,_0x14d19e=_0x58035e();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x4add62=_0x3e2b;(function(_0x58035e,_0x22fce0){const _0x16dcc2=_0x3e2b,_0x14d19e=_0x58035e();while(!![]){try{con

HIGH obfuscation-hex-functions: src/exportpdfui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x4add62=_0x3e2b;(function(_0x58035e,_0x22fce0){const _0x16dcc2=_0x3e2b,_0x14d19e=_0x58035e();while(!![]){try{con

HIGH obfuscation-while-true: src/index.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x28d76b,_0x512f96){var _0x107405=_0x1dc0,_0x443473=_0x28d76b();while(!![]){try{var _0x120aaa=parseInt(_0x107

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x28d76b,_0x512f96){var _0x107405=_0x1dc0,_0x443473=_0x28d76b();while(!![]){try{var _0x120aaa=parseInt(_0x107

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x28d76b,_0x512f96){var _0x107405=_0x1dc0,_0x443473=_0x28d76b();while(!![]){try{var _0x120aaa=parseInt(_0x107

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.6.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.