@lblod/ember-rdfa-editor

Ember addon wrapping an RDFa editor with a public API

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

erikapnielsvmadnificentcecemelclairelovisadietroscar.redpencilaatauil

Keywords

ember-addon

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:ember-resources	AI (phantom-deps): Ember v2 addon; ember-resources referenced in config/build files, not direct imports — stable false positive for this package.	ai	2026/06/03
npm-metadata	url-dep:prosemirror-history	AI (npm-metadata): Vendored tarball is in devDependencies only; does not affect consumers and is a stable pattern for this package.	ai	2026/05/18
publish-pattern	rapid-publish	AI (publish-pattern): High-velocity active project with 593 versions; rapid successive publishes are normal for this package.	ai	2026/05/05
dependencies	unvetted-dep:ember-velcro	AI (dependencies): Known Ember positioning addon; expected dep for this editor.	ai	2026/04/30
dependencies	unvetted-dep:@lblod/marawa	AI (dependencies): Same org (@lblod) RDFa utility; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:mdn-polyfills	AI (dependencies): Standard polyfill library; stable for this package.	ai	2026/04/30
dependencies	unvetted-dep:ember-focus-trap	AI (dependencies): Known Ember accessibility addon; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:ember-cli-htmlbars	AI (dependencies): Core Ember build tool; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:ember-headless-form	AI (dependencies): Known Ember form addon; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:ember-truth-helpers	AI (dependencies): Ubiquitous Ember template helper addon; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:@ember/render-modifiers	AI (dependencies): Official Ember modifier package; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:ember-headless-form-yup	AI (dependencies): Companion to ember-headless-form; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:@ember/optional-features	AI (dependencies): Official Ember CLI package; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:@curvenote/prosemirror-utils	AI (dependencies): ProseMirror utility fork; expected for this editor.	ai	2026/04/30
dependencies	unvetted-dep:@say-editor/prosemirror-tables	AI (dependencies): Same ecosystem (@say-editor) ProseMirror fork; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:@say-editor/prosemirror-invisibles	AI (dependencies): Same ecosystem (@say-editor) ProseMirror fork; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:ember-template-imports	AI (dependencies): Ember template imports tooling; expected dep.	ai	2026/04/30
dependencies	unvetted-dep:@glint/tsserver-plugin	AI (dependencies): Glint TypeScript tooling; expected for typed Ember addon.	ai	2026/04/30
dependencies	unvetted-dep:iter-tools	AI (dependencies): Legitimate utility library; stable dep for this package.	ai	2026/04/30
phantom-deps	phantom-dep:ember-cli-babel	AI (phantom-deps): Ember build tooling loaded by convention; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:@glint/tsserver-plugin	AI (phantom-deps): TypeScript tooling, not a runtime import; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:ember-template-imports	AI (phantom-deps): Build-time Ember tooling; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:@ember/optional-features	AI (phantom-deps): Ember build config package; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:prosemirror-schema-basic	AI (phantom-deps): Re-exported via dist bundle; stable false positive for this package.	ai	2026/04/29
phantom-deps	phantom-dep:@codemirror/lang-xml	AI (phantom-deps): CodeMirror language pack used in build; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:@types/react	AI (phantom-deps): Type-only dep for framework interop; stable false positive.	ai	2026/04/29
provenance	no-provenance	AI (provenance): Established org package; lack of Sigstore provenance is common and not a risk signal here.	ai	2026/04/29
phantom-deps	phantom-dep:mdn-polyfills	AI (phantom-deps): Polyfill loaded by convention in config, not direct import; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:common-tags	AI (phantom-deps): Utility declared but not directly imported; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:mongoose	AI (phantom-deps): Declared but not imported in frontend addon; likely an erroneous dep entry, not malicious.	ai	2026/04/29
phantom-deps	phantom-dep:typedoc	AI (phantom-deps): Build/doc tool, not a runtime dep; stable false positive for this package.	ai	2026/04/29