@codingame/monaco-vscode-api

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

nonofrsamuel.oliviernantoniazzimaximecgcodingame_team

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:external/vscode-textmate/release/main.js	AI (source-diff): Bundled vscode-textmate UMD release, minified build output not obfuscation.	ai	2026/07/15
dependencies	unvetted-dep:@vscode/diff	AI (dependencies): Official @vscode namespace dependency.	ai	2026/07/09
semgrep	semgrep:toplevel-fetch	AI (semgrep): fetch() in tree-sitter.js loads WASM binary; standard Emscripten/WASM loading pattern.	ai	2026/04/30
semgrep	semgrep:eval-usage	AI (semgrep): eval() in tree-sitter.js is Emscripten EM_ASM pattern; not user-controlled input.	ai	2026/04/30
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): 127.0.0.1 is a localhost OAuth redirect URI in VSCode's oauth.js; not exfiltration.	ai	2026/04/30
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() is VSCode's extension host loader pattern; stable across versions.	ai	2026/04/30

Versions (showing 51 of 60)

View all versions

Version	Deps	Published
35.0.1	12 / 0	2026-07-15
35.0.0	12 / 0	2026-07-09
34.1.0	12 / 0	2026-06-25
34.0.3	12 / 0	2026-06-18
34.0.0	12 / 0	2026-06-16
33.0.6	11 / 0	2026-05-22
33.0.5	11 / 0	2026-05-22
33.0.3	11 / 0	2026-05-22
32.0.0	11 / 0	2026-05-13
31.0.1	11 / 0	2026-05-07
31.0.0	11 / 0	2026-04-28
30.0.1	11 / 0	2026-04-13
30.0.0	11 / 0	2026-04-01
29.1.1	11 / 0	2026-03-31
29.1.0	11 / 0	2026-03-31
29.0.0	11 / 0	2026-03-30
28.4.1	11 / 0	2026-03-23
28.4.0	11 / 0	2026-03-23
28.3.1	11 / 0	2026-03-20
28.3.0	11 / 0	2026-03-19
28.2.0	11 / 0	2026-03-18
28.1.2	11 / 0	2026-03-18
28.1.1	11 / 0	2026-03-17
28.0.1	11 / 0	2026-03-10
28.0.0	11 / 0	2026-03-09
27.0.0	11 / 0	2026-03-05
26.2.2	11 / 0	2026-03-05
26.2.1	11 / 0	2026-02-23
26.2.0	11 / 0	2026-02-19
26.1.2	11 / 0	2026-02-13
26.1.1	11 / 0	2026-02-12
26.1.0	11 / 0	2026-02-11
26.0.1	11 / 0	2026-02-10
26.0.0	11 / 0	2026-02-09
25.1.2	11 / 0	2026-02-03
25.1.1	11 / 0	2026-02-02
25.1.0	11 / 0	2026-01-29
25.0.1	11 / 0	2026-01-21
25.0.0	11 / 0	2026-01-12
24.3.0	11 / 0	2026-01-07
24.2.0	11 / 0	2025-12-19
24.1.1	11 / 0	2025-12-18
24.1.0	11 / 0	2025-12-18
23.3.0	11 / 0	2025-12-09
23.2.2	11 / 0	2025-11-26
23.2.1	11 / 0	2025-11-25
23.2.0	11 / 0	2025-11-25
23.1.1	11 / 0	2025-11-24
23.1.0	11 / 0	2025-11-21
23.0.4	11 / 0	2025-11-20
23.0.3	11 / 0	2025-11-17

v35.0.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v35.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v33.0.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v33.0.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v32.0.0

1 finding

HIGH Provenance attestation missing — previous versions had it provenance

This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.

v28.4.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.4.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.3.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.3.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.2.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.1.2

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.1.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.0.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v28.0.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v27.0.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.2.2

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.2.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.2.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.1.2

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.1.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.1.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.0.1

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v26.0.0

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v25.1.2

2 findings

HIGH New obfuscated file: external/vscode-textmate/release/main.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v25.1.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v25.1.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v25.0.1

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: samuel.olivier → GitHub Actions (on 2026-01-21, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (samuel.olivier) on 2026-01-21, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v25.0.0

2 findings

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: samuel.olivier → GitHub Actions (on 2026-01-12, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (samuel.olivier) on 2026-01-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v24.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v24.1.1

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: codingame_team → samuel.olivier (on 2025-12-18, known maintainer) provenance

This version was published by a different npm account (samuel.olivier) than the most recent previously approved version (codingame_team) on 2025-12-18, but samuel.olivier is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v24.1.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: codingame_team → samuel.olivier (on 2025-12-18, known maintainer) provenance

This version was published by a different npm account (samuel.olivier) than the most recent previously approved version (codingame_team) on 2025-12-18, but samuel.olivier is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v23.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v23.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.