@khanacademy/simple-markdown
Javascript markdown parsing, made simple
46
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
khanacademy
Keywords
markdown
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@khanacademy/perseus-core | AI (dependencies): First-party Khan Academy dependency from the same monorepo; publisher has strong track record. Stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/es/index.js | AI (source-diff): dist/es/index.js is a standard bundled ES module output for this library. Long lines are due to minification/bundling, not obfuscation. Code is readable markdown parsing logic with no malicious patterns. | ai | |
| provenance | publisher-changed | AI (provenance): Khan Academy migrated publishing to GitHub Actions CI/CD with SLSA provenance attestation; the publisher change from 'khanacademy' to 'GitHub Actions' is a legitimate pipeline migration, not a takeover. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy is explained by the CI/CD pipeline migration; SLSA attestation confirms the publish originated from the official Khan/perseus GitHub repo workflow. | ai |
Versions (showing 46 of 46)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 1 / 1 | |
| 2.2.3 | 1 / 1 | |
| 2.2.2 | 1 / 1 | |
| 2.2.1 | 1 / 1 | |
| 2.2.0 | 1 / 1 | |
| 2.1.4 | 1 / 1 | |
| 2.1.3 | 1 / 1 | |
| 2.1.2 | 1 / 1 | |
| 2.1.1 | 1 / 1 | |
| 2.1.0 | 1 / 1 | |
| 2.0.10 | 1 / 1 | |
| 2.0.9 | 1 / 1 | |
| 2.0.8 | 1 / 1 | |
| 2.0.7 | 1 / 1 | |
| 2.0.6 | 1 / 1 | |
| 2.0.5 | 1 / 1 | |
| 2.0.4 | 1 / 1 | |
| 2.0.3 | 1 / 1 | |
| 2.0.2 | 1 / 1 | |
| 2.0.1 | 1 / 1 | |
| 2.0.0 | 1 / 1 | |
| 1.0.0 | 1 / 1 | |
| 0.14.1 | 1 / 1 | |
| 0.14.0 | 0 / 1 | |
| 0.13.20 | 1 / 1 | |
| 0.13.19 | 1 / 1 | |
| 0.13.18 | 1 / 1 | |
| 0.13.17 | 1 / 1 | |
| 0.13.16 | 1 / 1 | |
| 0.13.15 | 1 / 1 | |
| 0.13.14 | 1 / 1 | |
| 0.13.13 | 1 / 1 | |
| 0.13.12 | 1 / 1 | |
| 0.13.11 | 1 / 1 | |
| 0.13.9 | 1 / 1 | |
| 0.13.8 | 1 / 1 | |
| 0.13.7 | 1 / 1 | |
| 0.13.6 | 1 / 1 | |
| 0.13.5 | 1 / 1 | |
| 0.13.4 | 1 / 1 | |
| 0.13.3 | 1 / 1 | |
| 0.13.2 | 1 / 1 | |
| 0.13.1 | 1 / 1 | |
| 0.13.0 | 1 / 1 | |
| 0.12.1 | 1 / 1 | |
| 0.12.0 | 1 / 1 |
v3.0.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.