@ckeditor/ckeditor5-slash-command SEE LICENSE IN LICENSE.md 15 versions

@ckeditor/ckeditor5-slash-command

npm Homepage

Slash command feature for CKEditor 5.

Versions

SEE LICENSE IN LICENSE.md

License

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

ckeditor

Keywords

ckeditorckeditor5ckeditor 5ckeditor5-featureckeditor5-plugin

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:src/utils/common-translations.js	AI (source-diff): CKSource intentionally obfuscates commercial plugin source; package.json declares 'obfuscated: true' and copyright header confirms proprietary obfuscation. Stable for this package.	ai	2026/04/26
semgrep	semgrep:obfuscation-while-true	AI (semgrep): CKEditor premium plugins intentionally ship obfuscated code; package.json declares 'obfuscated: true'. This is a stable, documented practice for this package family.	ai	2026/04/26
semgrep	semgrep:obfuscation-hex-functions	AI (semgrep): CKEditor premium plugins intentionally ship obfuscated code; package.json declares 'obfuscated: true'. This is a stable, documented practice for this package family.	ai	2026/04/26
phantom-deps	phantom-dep:@ckeditor/ckeditor5-ui	AI (phantom-deps): Same-org phantom deps are typical of CKEditor 5 monorepo structure where deps are resolved via the umbrella ckeditor5 package.	ai	2026/04/26
phantom-deps	phantom-dep:@ckeditor/ckeditor5-core	AI (phantom-deps): Same-org phantom deps are typical of CKEditor 5 monorepo structure where deps are resolved via the umbrella ckeditor5 package.	ai	2026/04/26
phantom-deps	phantom-dep:@ckeditor/ckeditor5-mention	AI (phantom-deps): Same-org phantom deps are typical of CKEditor 5 monorepo structure where deps are resolved via the umbrella ckeditor5 package.	ai	2026/04/26
dependencies	unvetted-dep:@ckeditor/ckeditor5-template	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25
phantom-deps	phantom-dep:@ckeditor/ckeditor5-icons	AI (phantom-deps): Same-org @ckeditor package; conditional/indirect usage is a known CKEditor 5 monorepo pattern.	ai	2026/04/25
phantom-deps	phantom-dep:@ckeditor/ckeditor5-style	AI (phantom-deps): Same-org @ckeditor package; conditional/indirect usage is a known CKEditor 5 monorepo pattern.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-ui	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25
phantom-deps	phantom-dep:@ckeditor/ckeditor5-template	AI (phantom-deps): Same-org @ckeditor package; conditional/indirect usage is a known CKEditor 5 monorepo pattern.	ai	2026/04/25
provenance	no-provenance	AI (provenance): CKSource is an established commercial publisher; absence of Sigstore provenance is common and not a risk signal here.	ai	2026/04/25
phantom-deps	phantom-dep:@ckeditor/ckeditor5-heading	AI (phantom-deps): Same-org @ckeditor package; conditional/indirect usage is a known CKEditor 5 monorepo pattern.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-core	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-style	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-utils	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-heading	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25
dependencies	unvetted-dep:@ckeditor/ckeditor5-mention	AI (dependencies): First-party @ckeditor sibling package published simultaneously at the same version; not an independent supply chain risk.	ai	2026/04/25

Versions (showing 15 of 15)

Version	Deps	Published
48.2.0	8 / 0	2026-06-02
48.1.1	8 / 0	2026-05-18
48.1.0	8 / 0	2026-05-13
48.0.1	8 / 0	2026-04-22
48.0.0	8 / 0	2026-03-31
47.7.2	9 / 0	2026-05-18
47.7.1	9 / 0	2026-04-23
47.7.0	9 / 0	2026-04-16
47.6.2	9 / 0	2026-04-08
47.6.1	9 / 0	2026-03-11
47.6.0	9 / 0	2026-03-04
47.5.0	9 / 0	2026-02-11
47.4.0	9 / 0	2026-01-14
47.3.0	9 / 0	2025-12-03
47.2.0	9 / 0	2025-11-05

v48.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v48.1.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v48.1.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v48.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v48.0.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.7.2

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.7.1

56 findings

HIGH New obfuscated file: src/utils/common-translations.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH obfuscation-while-true: src/index.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x5e15b9,_0x241ba9){var _0x2dae82=_0xa5c7,_0x44ab2f=_0x5e15b9();while(!![]){try{var _0x4de921=parseInt(_0x2da

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x5e15b9,_0x241ba9){var _0x2dae82=_0xa5c7,_0x44ab2f=_0x5e15b9();while(!![]){try{var _0x4de921=parseInt(_0x2da

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

HIGH obfuscation-while-true: src/legacyerrors.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x58742f,_0x2db315){var _0x2e1205=_0x3e2d,_0xf1797=_0x58742f();while(!![]){try{var _0x4ca1f4=parseInt(_0x2e12

HIGH obfuscation-hex-functions: src/legacyerrors.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x58742f,_0x2db315){var _0x2e1205=_0x3e2d,_0xf1797=_0x58742f();while(!![]){try{var _0x4ca1f4=parseInt(_0x2e12

HIGH obfuscation-hex-functions: src/legacyerrors.js:23 semgrep

HIGH obfuscation-hex-functions: src/slashcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | function _0x1a8e(){var _0x549ae9=['108jYusvg','3LXkVPz','1158630NRxqRz','689136SqBtAl','1364598iCGwNP','pluginName','236

HIGH obfuscation-while-true: src/slashcommand.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | function _0x1a8e(){var _0x549ae9=['108jYusvg','3LXkVPz','1158630NRxqRz','689136SqBtAl','1364598iCGwNP','pluginName','236

HIGH obfuscation-hex-functions: src/slashcommand.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommandconfig.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x30b2d5=_0xbef1;(function(_0x44a017,_0x110cba){const _0x4ea00b=_0xbef1,_0x56fedd=_0x44a017();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandconfig.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x30b2d5=_0xbef1;(function(_0x44a017,_0x110cba){const _0x4ea00b=_0xbef1,_0x56fedd=_0x44a017();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandconfig.js:23 semgrep

HIGH obfuscation-hex-functions: src/slashcommandediting.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | function _0x1b48(_0x3be86a,_0x2734da){const _0x3fe5e0=_0x3fe5();return _0x1b48=function(_0x1b4877,_0x2d4eae){_0x1b4877=_

HIGH obfuscation-hex-functions: src/slashcommandediting.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommandediting.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | function _0x1b48(_0x3be86a,_0x2734da){const _0x3fe5e0=_0x3fe5();return _0x1b48=function(_0x1b4877,_0x2d4eae){_0x1b4877=_

HIGH obfuscation-while-true: src/slashcommandui.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x5ca5b6=_0x5984;(function(_0xe8728f,_0x57c544){const _0x238fd5=_0x5984,_0x47afd9=_0xe8728f();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x5ca5b6=_0x5984;(function(_0xe8728f,_0x57c544){const _0x238fd5=_0x5984,_0x47afd9=_0xe8728f();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandui.js:23 semgrep

HIGH obfuscation-hex-functions: src/ui/slashcommandbuttonview.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x4b4d89=_0x238d;function _0x4a6b(){const _0x45cdf2=['76260930Zqxqum','description','21uQIAfp','83MacIjG','labelV

HIGH obfuscation-hex-functions: src/ui/slashcommandbuttonview.js:23 semgrep

HIGH obfuscation-while-true: src/ui/slashcommandbuttonview.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x4b4d89=_0x238d;function _0x4a6b(){const _0x45cdf2=['76260930Zqxqum','description','21uQIAfp','83MacIjG','labelV

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.7.0

56 findings

HIGH New obfuscated file: src/utils/common-translations.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH obfuscation-while-true: src/index.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x4ba99f,_0xd41c1e){var _0x598ac2=_0x26de,_0x28902c=_0x4ba99f();while(!![]){try{var _0xfff96d=parseInt(_0x598

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x4ba99f,_0xd41c1e){var _0x598ac2=_0x26de,_0x28902c=_0x4ba99f();while(!![]){try{var _0xfff96d=parseInt(_0x598

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

HIGH obfuscation-while-true: src/legacyerrors.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x129778,_0x1e75b3){var _0x16d904=_0x19c7,_0x1604f1=_0x129778();while(!![]){try{var _0x44e850=parseInt(_0x16d

HIGH obfuscation-hex-functions: src/legacyerrors.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x129778,_0x1e75b3){var _0x16d904=_0x19c7,_0x1604f1=_0x129778();while(!![]){try{var _0x44e850=parseInt(_0x16d

HIGH obfuscation-hex-functions: src/legacyerrors.js:23 semgrep

HIGH obfuscation-hex-functions: src/slashcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | function _0x3ae3(){var _0x4cfabf=['15XwKKno','10GgvWVb','1038278ekvdag','requires','273474AfyNoi','pluginName','20256071

HIGH obfuscation-while-true: src/slashcommand.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | function _0x3ae3(){var _0x4cfabf=['15XwKKno','10GgvWVb','1038278ekvdag','requires','273474AfyNoi','pluginName','20256071

HIGH obfuscation-hex-functions: src/slashcommand.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommandconfig.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x485b23=_0x25f0;(function(_0x6deaf3,_0x44539f){const _0x2416d6=_0x25f0,_0x5d4fbf=_0x6deaf3();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandconfig.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x485b23=_0x25f0;(function(_0x6deaf3,_0x44539f){const _0x2416d6=_0x25f0,_0x5d4fbf=_0x6deaf3();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandconfig.js:23 semgrep

HIGH obfuscation-hex-functions: src/slashcommandediting.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x358065=_0x5ca5;function _0x5af9(){const _0x8d710e=['title','7753690cXybMk','concat','description','getAllowedCo

HIGH obfuscation-hex-functions: src/slashcommandediting.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommandediting.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x358065=_0x5ca5;function _0x5af9(){const _0x8d710e=['title','7753690cXybMk','concat','description','getAllowedCo

HIGH obfuscation-hex-functions: src/slashcommandui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | function _0x50b1(_0x436318,_0x2ab8fa){const _0x5d9363=_0x5d93();return _0x50b1=function(_0x50b181,_0x5eb5a7){_0x50b181=_

HIGH obfuscation-while-true: src/slashcommandui.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | function _0x50b1(_0x436318,_0x2ab8fa){const _0x5d9363=_0x5d93();return _0x50b1=function(_0x50b181,_0x5eb5a7){_0x50b181=_

HIGH obfuscation-hex-functions: src/slashcommandui.js:23 semgrep

HIGH obfuscation-while-true: src/ui/slashcommandbuttonview.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x62ba0f=_0x572f;(function(_0x5d33af,_0x2452cc){const _0x365494=_0x572f,_0x15b395=_0x5d33af();while(!![]){try{con

HIGH obfuscation-hex-functions: src/ui/slashcommandbuttonview.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x62ba0f=_0x572f;(function(_0x5d33af,_0x2452cc){const _0x365494=_0x572f,_0x15b395=_0x5d33af();while(!![]){try{con

HIGH obfuscation-hex-functions: src/ui/slashcommandbuttonview.js:23 semgrep

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.6.2

55 findings

HIGH obfuscation-while-true: src/index.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x46278c,_0x2c0bc8){var _0x2019fe=_0x430e,_0x37fb7b=_0x46278c();while(!![]){try{var _0x7971cd=-parseInt(_0x20

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x46278c,_0x2c0bc8){var _0x2019fe=_0x430e,_0x37fb7b=_0x46278c();while(!![]){try{var _0x7971cd=-parseInt(_0x20

HIGH obfuscation-hex-functions: src/index.js:23 semgrep

HIGH obfuscation-while-true: src/legacyerrors.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | (function(_0x8cbc1b,_0x1eeb2e){var _0x10ea29=_0x4837,_0x3e7cd1=_0x8cbc1b();while(!![]){try{var _0x52affe=-parseInt(_0x10

HIGH obfuscation-hex-functions: src/legacyerrors.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | (function(_0x8cbc1b,_0x1eeb2e){var _0x10ea29=_0x4837,_0x3e7cd1=_0x8cbc1b();while(!![]){try{var _0x52affe=-parseInt(_0x10

HIGH obfuscation-hex-functions: src/legacyerrors.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommand.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | var _0x5d67de=_0x227b;(function(_0x3dd20b,_0x56fc01){var _0x3ab314=_0x227b,_0x4e56e4=_0x3dd20b();while(!![]){try{var _0x

HIGH obfuscation-hex-functions: src/slashcommand.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | var _0x5d67de=_0x227b;(function(_0x3dd20b,_0x56fc01){var _0x3ab314=_0x227b,_0x4e56e4=_0x3dd20b();while(!![]){try{var _0x

HIGH obfuscation-hex-functions: src/slashcommand.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommandconfig.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x552862=_0x3fbf;(function(_0x3dafb9,_0x2ee1d0){const _0x5d86e4=_0x3fbf,_0x5ac405=_0x3dafb9();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandconfig.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x552862=_0x3fbf;(function(_0x3dafb9,_0x2ee1d0){const _0x5d86e4=_0x3fbf,_0x5ac405=_0x3dafb9();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandconfig.js:23 semgrep

HIGH obfuscation-hex-functions: src/slashcommandediting.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x57c917=_0x1ad2;function _0x3bab(){const _0x28afce=['some','aliases','concat','isOfficialPlugin','push','113720I

HIGH obfuscation-while-true: src/slashcommandediting.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x57c917=_0x1ad2;function _0x3bab(){const _0x28afce=['some','aliases','concat','isOfficialPlugin','push','113720I

HIGH obfuscation-hex-functions: src/slashcommandediting.js:23 semgrep

HIGH obfuscation-while-true: src/slashcommandui.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x2f2ed6=_0x320f;(function(_0x3e1206,_0x113c06){const _0x420c28=_0x320f,_0x3329b1=_0x3e1206();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandui.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x2f2ed6=_0x320f;(function(_0x3e1206,_0x113c06){const _0x420c28=_0x320f,_0x3329b1=_0x3e1206();while(!![]){try{con

HIGH obfuscation-hex-functions: src/slashcommandui.js:23 semgrep

HIGH obfuscation-hex-functions: src/ui/slashcommandbuttonview.js:23 semgrep

Hex-prefixed function names (_0x...) are generated by javascript-obfuscator 21 | * 22 | */ > 23 | const _0x376a40=_0xf651;function _0x1a52(){const _0x28d0c2=['title','ck-slash-command-button__text-part','83kTEJup','isC

HIGH obfuscation-while-true: src/ui/slashcommandbuttonview.js:23 semgrep

while(!![]) loop is a signature of javascript-obfuscator output 21 | * 22 | */ > 23 | const _0x376a40=_0xf651;function _0x1a52(){const _0x28d0c2=['title','ck-slash-command-button__text-part','83kTEJup','isC

HIGH obfuscation-hex-functions: src/ui/slashcommandbuttonview.js:23 semgrep

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.6.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.5.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v47.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v47.2.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.