@ckeditor/ckeditor5-import-word
Import from Word feature for CKEditor 5.
18
Versions
SEE LICENSE IN LICENSE.md
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
ckeditor
Keywords
ckeditorckeditor5ckeditor 5ckeditor5-featureckeditor5-pluginWYSIWYGWYSIWYMtextrich-textrichtextckeditoreditoreditinghtmlcontentEditableWordprint Wordopen Wordconvert from Wordimport Wordimport from WordWord converterWord to HTML
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Large file count is expected for a full CKEditor5 plugin package with many source modules. | ai | |
| source-diff | obfuscated-file:src/importwordediting.js | AI (source-diff): CKEditor5 premium plugin ships intentionally obfuscated source; declared in package.json with obfuscated:true. | ai | |
| source-diff | obfuscated-file:src/importwordcommand.js | AI (source-diff): CKSource intentionally obfuscates commercial plugin source; package.json declares 'obfuscated: true'. Copyright header explicitly states proprietary obfuscated code. | ai | |
| source-diff | obfuscated-file:build/import-word.js | AI (source-diff): CKSource intentionally ships obfuscated build artifacts for commercial plugins; package.json declares 'obfuscated: true'. Build directory output is expected. | ai | |
| source-diff | obfuscated-file:src/importwordui.js | AI (source-diff): CKSource intentionally obfuscates commercial plugin source; package.json declares 'obfuscated: true'. Copyright header explicitly states proprietary obfuscated code. | ai | |
| semgrep | semgrep:obfuscation-while-true | AI (semgrep): CKSource commercial plugin with explicit 'obfuscated: true' in package.json. Intentional IP protection, not malware. Stable across all versions of this package. | ai | |
| semgrep | semgrep:obfuscation-hex-functions | AI (semgrep): CKSource commercial plugin with explicit 'obfuscated: true' in package.json. Intentional IP protection, not malware. Stable across all versions of this package. | ai | |
| phantom-deps | phantom-dep:@ckeditor/ckeditor5-ui | AI (phantom-deps): Same-org @ckeditor scoped dep declared for version-pinning in CKEditor's modular architecture. Not a security concern. | ai | |
| phantom-deps | phantom-dep:@ckeditor/ckeditor5-core | AI (phantom-deps): Same-org @ckeditor scoped dep declared for version-pinning in CKEditor's modular architecture. Not a security concern. | ai | |
| phantom-deps | phantom-dep:@ckeditor/ckeditor5-engine | AI (phantom-deps): Same-org @ckeditor scoped dep declared for version-pinning in CKEditor's modular architecture. Not a security concern. | ai | |
| phantom-deps | phantom-dep:@ckeditor/ckeditor5-clipboard | AI (phantom-deps): Same-org @ckeditor scoped dep declared for version-pinning in CKEditor's modular architecture. Not a security concern. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-clipboard | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-engine | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-utils | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-core | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-cloud-services | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai | |
| phantom-deps | phantom-dep:@ckeditor/ckeditor5-icons | AI (phantom-deps): Same-org phantom dep; common in CKEditor 5 monorepo for transitive/peer resolution. Not a security concern. | ai | |
| phantom-deps | phantom-dep:@ckeditor/ckeditor5-merge-fields | AI (phantom-deps): Same-org phantom dep; common in CKEditor 5 monorepo for transitive/peer resolution. Not a security concern. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-merge-fields | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai | |
| dependencies | unvetted-dep:@ckeditor/ckeditor5-ui | AI (dependencies): First-party @ckeditor org dependency at matching version; part of coordinated CKEditor 5 monorepo release. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 48.3.1 | 8 / 0 | |
| 48.3.0 | 8 / 0 | |
| 48.2.0 | 8 / 0 | |
| 48.1.1 | 8 / 0 | |
| 48.1.0 | 8 / 0 | |
| 48.0.1 | 8 / 0 | |
| 48.0.0 | 8 / 0 | |
| 47.7.3 | 9 / 0 | |
| 47.7.2 | 9 / 0 | |
| 47.7.1 | 9 / 0 | |
| 47.7.0 | 9 / 0 | |
| 47.6.2 | 9 / 0 | |
| 47.6.1 | 9 / 0 | |
| 47.6.0 | 9 / 0 | |
| 47.5.0 | 9 / 0 | |
| 47.4.0 | 9 / 0 | |
| 47.3.0 | 9 / 0 | |
| 47.2.0 | 9 / 0 |
v48.3.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v48.3.0
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v47.7.3
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.