@khanacademy/perseus-core No license 26 versions

@khanacademy/perseus-core

npm Repository Homepage

26

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

khanacademy

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	large-new-source-files	AI (source-diff): Major version bump (1.x → 18.x) for an established KA package; large file count increase reflects architectural consolidation, not injected code.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): New deps are all KA first-party packages plus tiny-invariant (well-known utility); consistent with major version refactor of Perseus framework.	ai	2026/04/24
source-diff	source-size-tripled	AI (source-diff): 31x size increase is explained by major version evolution consolidating multiple sub-packages; publisher is trusted KA account with long track record.	ai	2026/04/24
source-diff	obfuscated-file:dist/index.item-splitting.js	AI (source-diff): Standard minified CJS build output. Same legitimate math library code as the ES module variant. Normal build artifact for this package.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): Khan Academy legitimately transitioned to GitHub Actions CI/CD publishing; SLSA provenance attestation confirms builds come from official Khan/perseus repo. This is a stable organizational change.	ai	2026/04/24
provenance	missing-githead	AI (provenance): GitHub Actions publish environment doesn't set gitHead; SLSA Sigstore attestation provides stronger commit-level provenance than gitHead field.	ai	2026/04/24
source-diff	obfuscated-file:dist/es/index.item-splitting.js	AI (source-diff): Standard minified build output for Khan Academy's math library. Code samples show legitimate educational math utilities (approximateEqual, KAS integration). Normal build artifact.	ai	2026/04/24
dependencies	unvetted-dep:@khanacademy/pure-markdown	AI (dependencies): First-party Khan Academy package from the same Perseus monorepo org; unvetted flag is a pipeline artifact, not a real risk.	ai	2026/04/24
dependencies	unvetted-dep:@khanacademy/kas	AI (dependencies): First-party Khan Academy package from the same Perseus monorepo org; unvetted flag is a pipeline artifact, not a real risk.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): Internal Khan Academy monorepo package; sparse README and no keywords are expected for org-internal packages, not spam indicators.	ai	2026/04/24

Versions (showing 26 of 128)

Version	Deps	Published
6.0.0	2 / 3	2025-03-28
5.4.2	2 / 3	2025-03-26
5.4.1	1 / 2	2025-03-25
5.4.0	1 / 2	2025-03-20
5.3.0	1 / 2	2025-03-20
5.2.0	1 / 2	2025-03-19
5.1.0	1 / 2	2025-03-12
5.0.0	1 / 2	2025-03-05
4.0.0	0 / 2	2025-03-03
3.7.0	0 / 1	2025-02-18
3.6.0	0 / 1	2025-02-14
3.5.0	0 / 1	2025-02-10
3.4.0	0 / 1	2025-02-03
3.3.0	0 / 1	2025-01-27
3.2.0	0 / 1	2025-01-20
3.1.0	0 / 1	2025-01-13
3.0.5	0 / 1	2024-12-19
3.0.4	0 / 1	2024-12-19
3.0.3	0 / 1	2024-12-18
3.0.1	0 / 1	2024-12-18
3.0.0	0 / 1	2024-12-16
2.0.0	0 / 1	2024-12-12
1.5.3	0 / 1	2024-10-31
1.5.2	0 / 0	2024-10-07
1.5.1	0 / 0	2024-10-03
1.5.0	0 / 0	2024-07-15

v6.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.7.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.6.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.