@idan_ariav/qmd MIT 2 versions

@idan_ariav/qmd

npm Repository Homepage

Query Markup Documents - On-device hybrid search for markdown files with BM25, vector search, and LLM reranking

Versions

MIT

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

idan_ariav

markdownsearchftsfull-text-searchvectorsemantic-searchsqlitebm25embeddingsragmcprerankingknowledge-baselocal-aillm

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
typosquat	typosquat.levenshtein:qs	AI (typosquat): Scoped package under author's own namespace; unrelated to qs, not a typosquat.	ai	2026/05/09
typosquat	typosquat.levenshtein:zod	AI (typosquat): Scoped package under author's own namespace; unrelated to zod, not a typosquat.	ai	2026/05/09
phantom-deps	phantom-dep:@types/mdast	AI (phantom-deps): @types/mdast is a type-only dependency used by remark/unified ecosystem; stable false positive.	ai	2026/05/09

Version	Deps	Published
2.3.1	14 / 5	2026-05-02
2.3.0	14 / 5	2026-04-26

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.