@jx3box/jx3box-editor
38
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
rx6x3zvawqkaviilee
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from human publisher to GitHub Actions CI/CD with SLSA provenance; legitimate automation. | ai | |
| source-diff | net-exec-file:src/assets/js/tex-mml-chtml.js | AI (source-diff): MathJax bundle legitimately loads fonts/resources at runtime; not a dropper pattern. | ai | |
| source-diff | obfuscated-file:src/assets/js/tex-mml-chtml.js | AI (source-diff): tex-mml-chtml.js is the standard MathJax webpack bundle; minification is expected and benign for this package. | ai | |
| dependencies | unvetted-dep:vue-contextmenujs | AI (dependencies): Pre-existing dep in this package; stable across versions. | ai | |
| dependencies | unvetted-dep:@jx3box/markdown | AI (dependencies): Same org scope (@jx3box); pre-existing dep, stable across versions. | ai | |
| dependencies | unvetted-dep:csslab | AI (dependencies): Pre-existing dep in this package; stable across versions. | ai | |
| dependencies | unvetted-dep:vue-gallery-slideshow | AI (dependencies): Pre-existing dep in this package; stable across versions. | ai | |
| dependencies | unvetted-dep:vue-photoswipe.js | AI (dependencies): Pre-existing dep in this package; stable across versions. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Established org package with 290 versions and clean publisher history; dormancy is not indicative of takeover given no code changes. | ai | |
| dependencies | unvetted-dep:hevue-img-preview | AI (dependencies): Image preview UI component; benign for an editor package. | ai | |
| dependencies | unvetted-dep:vue-plugin-load-script | AI (dependencies): Small Vue utility for dynamic script loading; consistent with TinyMCE integration pattern here. | ai | |
| dependencies | unvetted-dep:vditor | AI (dependencies): vditor is a well-known Markdown editor library; consistent with this editor package's purpose. | ai | |
| phantom-deps | phantom-dep:prismjs | AI (phantom-deps): Syntax highlighting loaded via config in editor context; not directly imported. | ai | |
| phantom-deps | phantom-dep:vue | AI (phantom-deps): Vue is a peer/config dependency for a Vue component library; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:csslab | AI (phantom-deps): CSS utility used via config/build pipeline, not direct import; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:core-js | AI (phantom-deps): Known implicit polyfill dependency; standard for Vue CLI projects. | ai | |
| phantom-deps | phantom-dep:element-ui | AI (phantom-deps): UI framework used as peer/config dep in Vue CLI project; stable pattern. | ai | |
| phantom-deps | phantom-dep:@jx3box/markdown | AI (phantom-deps): Same-org dep used via config; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:vue-contextmenujs | AI (phantom-deps): Vue plugin loaded via config; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:vue-photoswipe.js | AI (phantom-deps): Vue plugin loaded via config; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:vue-gallery-slideshow | AI (phantom-deps): Vue plugin loaded via config; not directly imported by design. | ai | |
| provenance | no-provenance | AI (provenance): Established org package; lack of Sigstore provenance is common and not a disqualifier here. | ai | |
| phantom-deps | phantom-dep:lodash | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:dayjs | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:@jx3box/jx3box-emotion | AI (phantom-deps): Same org scope; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@tinymce/tinymce-vue | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:github-markdown-css | AI (phantom-deps): Component library pattern; CSS dep referenced in config, not direct import. | ai | |
| phantom-deps | phantom-dep:vue-plugin-load-script | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:@imengyu/vue3-context-menu | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:@jx3box/jx3box-data | AI (phantom-deps): Same org scope; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:hevue-img-preview | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:vuedraggable | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:xss | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:sortablejs | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:vditor | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai | |
| phantom-deps | phantom-dep:lucide | AI (phantom-deps): Component library pattern; deps used via config/re-export, not direct import. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 3.2.12 | 30 / 38 | |
| 3.2.11 | 30 / 38 | |
| 3.2.10 | 30 / 38 | |
| 3.2.9 | 30 / 38 | |
| 3.2.8 | 30 / 38 | |
| 3.2.7 | 30 / 38 | |
| 3.2.6 | 30 / 38 | |
| 3.2.5 | 30 / 32 | |
| 3.2.4 | 30 / 32 | |
| 3.2.3 | 30 / 32 | |
| 3.2.2 | 30 / 32 | |
| 3.2.1 | 30 / 32 | |
| 3.2.0 | 30 / 32 | |
| 3.1.5 | 30 / 32 | |
| 3.1.4 | 30 / 32 | |
| 3.1.3 | 30 / 32 | |
| 3.1.2 | 30 / 32 | |
| 3.1.1 | 30 / 32 | |
| 3.1.0 | 30 / 32 | |
| 3.0.13 | 30 / 32 | |
| 3.0.12 | 30 / 32 | |
| 3.0.11 | 30 / 32 | |
| 3.0.10 | 30 / 32 | |
| 3.0.9 | 30 / 32 | |
| 3.0.8 | 30 / 29 | |
| 3.0.7 | 30 / 29 | |
| 3.0.6 | 30 / 29 | |
| 3.0.4 | 30 / 29 | |
| 3.0.3 | 30 / 29 | |
| 3.0.2 | 29 / 29 | |
| 3.0.1 | 29 / 29 | |
| 3.0.0 | 29 / 29 | |
| 2.2.48 | 32 / 15 | |
| 2.2.47 | 32 / 15 | |
| 2.2.46 | 32 / 15 | |
| 2.2.45 | 32 / 15 | |
| 2.2.44 | 30 / 15 | |
| 2.2.43 | 30 / 15 |
v3.2.12
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.11
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.10
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.9
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.8
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.7
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.6
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v3.2.5
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.