@herb-tools/language-server
Herb HTML+ERB Language Tools and Language Server Protocol integration.
37
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
marcoroth
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/index.cjs | AI (source-diff): Network and child_process imports are required by the LSP protocol implementation; no dropper behavior present. | ai | |
| source-diff | obfuscated-file:dist/index.cjs | AI (source-diff): Standard rollup CJS bundle output; minified lines are expected for this language-server package. | ai | |
| source-diff | encoded-string-file:dist/index.cjs | AI (source-diff): Same inline WASM blob in the CJS build. Legitimate Emscripten output; not a malicious payload. | ai | |
| source-diff | encoded-string-file:dist/herb-language-server.js | AI (source-diff): The encoded string is a base64-encoded WebAssembly binary (AGFzbQ prefix = WASM magic bytes). Shipping WASM as base64 in a JS bundle is standard practice for this package; stable false positive. | ai | |
| dependencies | unvetted-dep:@herb-tools/linter | AI (dependencies): Sibling package in the same herb-tools monorepo, same author and versioning scheme. Intra-monorepo dependency; not a meaningful risk for this package. | ai | |
| phantom-deps | phantom-dep:dedent | AI (phantom-deps): dedent is declared as a runtime dependency in package.json; the phantom-dep finding reflects it not being directly imported in source, which is a packaging style choice, not a security concern. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 36 versions and 9.6k weekly downloads; lack of Sigstore provenance is common and not a security signal for this package. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 0.10.2 | 9 / 1 | |
| 0.10.1 | 9 / 1 | |
| 0.10.0 | 9 / 1 | |
| 0.9.7 | 9 / 1 | |
| 0.9.6 | 9 / 1 | |
| 0.9.5 | 9 / 1 | |
| 0.9.4 | 9 / 1 | |
| 0.9.3 | 9 / 1 | |
| 0.9.2 | 9 / 1 | |
| 0.9.1 | 9 / 1 | |
| 0.9.0 | 9 / 1 | |
| 0.8.10 | 7 / 0 | |
| 0.8.9 | 7 / 0 | |
| 0.8.8 | 7 / 0 | |
| 0.8.7 | 7 / 0 | |
| 0.8.6 | 7 / 0 | |
| 0.8.5 | 7 / 0 | |
| 0.8.4 | 7 / 0 | |
| 0.8.3 | 7 / 0 | |
| 0.8.2 | 7 / 0 | |
| 0.8.1 | 7 / 0 | |
| 0.8.0 | 7 / 0 | |
| 0.7.5 | 6 / 1 | |
| 0.7.4 | 6 / 1 | |
| 0.7.3 | 6 / 1 | |
| 0.7.2 | 6 / 1 | |
| 0.7.1 | 6 / 1 | |
| 0.7.0 | 6 / 1 | |
| 0.6.1 | 6 / 1 | |
| 0.6.0 | 6 / 1 | |
| 0.5.0 | 6 / 1 | |
| 0.4.3 | 6 / 1 | |
| 0.4.2 | 6 / 1 | |
| 0.4.1 | 6 / 1 | |
| 0.4.0 | 6 / 0 | |
| 0.3.1 | 5 / 5 | |
| 0.3.0 | 5 / 5 |
v0.10.2
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.