@khanacademy/perseus-core
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Major version bump (1.x → 18.x) for an established KA package; large file count increase reflects architectural consolidation, not injected code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are all KA first-party packages plus tiny-invariant (well-known utility); consistent with major version refactor of Perseus framework. | ai | |
| source-diff | source-size-tripled | AI (source-diff): 31x size increase is explained by major version evolution consolidating multiple sub-packages; publisher is trusted KA account with long track record. | ai | |
| source-diff | obfuscated-file:dist/index.item-splitting.js | AI (source-diff): Standard minified CJS build output. Same legitimate math library code as the ES module variant. Normal build artifact for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Khan Academy legitimately transitioned to GitHub Actions CI/CD publishing; SLSA provenance attestation confirms builds come from official Khan/perseus repo. This is a stable organizational change. | ai | |
| provenance | missing-githead | AI (provenance): GitHub Actions publish environment doesn't set gitHead; SLSA Sigstore attestation provides stronger commit-level provenance than gitHead field. | ai | |
| source-diff | obfuscated-file:dist/es/index.item-splitting.js | AI (source-diff): Standard minified build output for Khan Academy's math library. Code samples show legitimate educational math utilities (approximateEqual, KAS integration). Normal build artifact. | ai | |
| dependencies | unvetted-dep:@khanacademy/pure-markdown | AI (dependencies): First-party Khan Academy package from the same Perseus monorepo org; unvetted flag is a pipeline artifact, not a real risk. | ai | |
| dependencies | unvetted-dep:@khanacademy/kas | AI (dependencies): First-party Khan Academy package from the same Perseus monorepo org; unvetted flag is a pipeline artifact, not a real risk. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal Khan Academy monorepo package; sparse README and no keywords are expected for org-internal packages, not spam indicators. | ai |
Versions (showing 51 of 139)
| Version | Deps | Published |
|---|---|---|
| 33.0.0 | 4 / 3 | |
| 32.0.1 | 4 / 3 | |
| 32.0.0 | 4 / 3 | |
| 31.0.0 | 4 / 3 | |
| 30.1.1 | 4 / 3 | |
| 30.1.0 | 4 / 3 | |
| 30.0.2 | 4 / 3 | |
| 30.0.1 | 4 / 3 | |
| 30.0.0 | 4 / 3 | |
| 29.0.0 | 4 / 3 | |
| 28.3.0 | 4 / 3 | |
| 28.2.0 | 4 / 3 | |
| 28.1.0 | 4 / 3 | |
| 28.0.1 | 4 / 3 | |
| 28.0.0 | 4 / 3 | |
| 27.4.0 | 4 / 3 | |
| 27.3.0 | 4 / 3 | |
| 27.2.0 | 4 / 3 | |
| 27.1.0 | 4 / 3 | |
| 27.0.3 | 4 / 3 | |
| 27.0.2 | 4 / 3 | |
| 27.0.1 | 4 / 3 | |
| 27.0.0 | 4 / 3 | |
| 26.3.1 | 4 / 3 | |
| 26.3.0 | 4 / 3 | |
| 26.2.0 | 4 / 3 | |
| 26.1.1 | 4 / 3 | |
| 26.1.0 | 4 / 3 | |
| 26.0.3 | 4 / 3 | |
| 26.0.2 | 4 / 3 | |
| 26.0.1 | 4 / 3 | |
| 26.0.0 | 4 / 3 | |
| 25.0.0 | 4 / 3 | |
| 24.1.1 | 4 / 3 | |
| 24.1.0 | 4 / 3 | |
| 24.0.0 | 4 / 3 | |
| 23.7.0 | 4 / 3 | |
| 23.6.1 | 4 / 3 | |
| 23.6.0 | 4 / 3 | |
| 23.5.0 | 4 / 3 | |
| 23.4.0 | 4 / 3 | |
| 23.3.0 | 4 / 3 | |
| 23.2.0 | 4 / 3 | |
| 23.1.0 | 4 / 3 | |
| 23.0.2 | 4 / 3 | |
| 23.0.1 | 4 / 3 | |
| 23.0.0 | 4 / 3 | |
| 22.1.0 | 4 / 3 | |
| 22.0.0 | 4 / 3 | |
| 21.2.1 | 4 / 3 | |
| 21.2.0 | 4 / 3 |
v33.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v32.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v32.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v31.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.1.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.1.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v30.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.