← Home

@lexical/html

npm Repository Homepage
100
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

fantactukazurfyxacywatsonipavlov001trueadmetrepum

Keywords

lexicaleditorrich-texthtml

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): Sibling in-monorepo package (lexical), not an external dependency. ai
maintainer-change maintainer-removed AI (maintainer-change): Same reshuffle; not a takeover given longevity and downloads. ai
maintainer-change maintainer-added AI (maintainer-change): Org-wide maintainer reshuffle on official Meta package, stable for 855+ days. ai
provenance publisher-changed-stale AI (provenance): Publisher change stale 855d without unpublish, consistent with legitimate transfer. ai
provenance publisher-changed AI (provenance): Transition from individual publisher to GitHub Actions CI/CD with SLSA provenance; stable for this package. ai
source-diff source-size-tripled AI (source-diff): Size growth from adding dev/prod/node build variants; normal for Lexical monorepo releases. ai
source-diff obfuscated-file:dist/LexicalHtml.prod.js AI (source-diff): Standard minified production bundle for this Meta-maintained package. ai
source-diff obfuscated-file:dist/LexicalHtml.prod.mjs AI (source-diff): Standard minified production ESM bundle for this Meta-maintained package. ai
provenance missing-githead AI (provenance): Established Facebook/Lexical package with clean metadata and no material code changes; missing gitHead likely reflects a CI pipeline change, not a supply chain compromise. ai
source-diff obfuscated-file:LexicalHtml.prod.js AI (source-diff): LexicalHtml.prod.js is a standard minified production build (long lines = minification, not obfuscation). This is Lexical's established dev/prod/node build pattern; stable false positive for this package. ai
source-diff obfuscated-file:LexicalHtml.prod.mjs AI (source-diff): LexicalHtml.prod.mjs is a standard minified ESM production build. Same reasoning as .prod.js — Lexical's documented build convention, not obfuscation. ai

Versions (showing 100 of 104)

Version Deps Published
0.48.0 5 / 0
0.47.0 5 / 0
0.46.0 5 / 0
0.45.0 5 / 0
0.44.0 4 / 0
0.43.0 3 / 0
0.42.0 3 / 0
0.41.0 3 / 0
0.40.0 3 / 0
0.39.0 3 / 0
0.38.2 3 / 0
0.38.1 3 / 0
0.38.0 3 / 0
0.37.0 3 / 0
0.36.2 3 / 0
0.36.1 3 / 0
0.36.0 3 / 0
0.35.0 3 / 0
0.34.0 3 / 0
0.33.1 3 / 0
0.33.0 3 / 0
0.32.1 3 / 0
0.32.0 3 / 0
0.31.2 3 / 0
0.31.1 3 / 0
0.31.0 3 / 0
0.30.0 3 / 0
0.29.0 3 / 0
0.28.0 3 / 0
0.27.2 3 / 0
0.27.1 3 / 0
0.27.0 3 / 0
0.26.0 3 / 0
0.25.0 3 / 0
0.24.0 3 / 0
0.23.1 3 / 0
0.23.0 3 / 0
0.22.0 3 / 0
0.21.0 3 / 0
0.20.2 3 / 0
0.20.1 3 / 0
0.20.0 3 / 0
0.19.0 3 / 0
0.18.0 3 / 0
0.17.1 3 / 0
0.17.0 3 / 0
0.16.1 3 / 0
0.16.0 3 / 0
0.15.0 3 / 0
0.14.5 3 / 0
0.14.4 3 / 0
0.14.3 3 / 0
0.14.2 2 / 0
0.14.1 2 / 0
0.14.0 2 / 0
0.13.1 2 / 0
0.13.0 2 / 0
0.12.6 2 / 0
0.12.5 2 / 0
0.12.4 2 / 0
0.12.3 2 / 0
0.12.2 1 / 0
0.12.1 1 / 0
0.12.0 1 / 0
0.11.3 1 / 0
0.11.2 1 / 0
0.11.1 1 / 0
0.11.0 1 / 0
0.10.0 1 / 0
0.9.2 1 / 0
0.9.1 1 / 0
0.9.0 1 / 0
0.8.1 1 / 0
0.8.0 1 / 0
0.7.9 1 / 0
0.7.8 1 / 0
0.7.7 1 / 0
0.7.6 1 / 0
0.7.5 1 / 0
0.7.4 1 / 0
0.7.3 1 / 0
0.7.2 1 / 0
0.7.1 1 / 0
0.7.0 1 / 0
0.6.5 1 / 0
0.6.4 1 / 0
0.6.3 1 / 0
0.6.2 1 / 0
0.6.0 1 / 0
0.5.0 1 / 0
0.4.1 1 / 0
0.4.0 1 / 0
0.3.11 1 / 0
0.3.10 1 / 0
0.3.9 1 / 0
0.3.8 1 / 0
0.3.7 1 / 0
0.3.6 0 / 0
0.3.5 0 / 0
0.3.4 0 / 0
Showing 100 of 104 Next page →

v0.48.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.30.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.29.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.28.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.27.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.26.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.25.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: acywatson → zurfyx (on 2025-02-21, known maintainer) provenance

This version was published by a different npm account (zurfyx) than the most recent previously approved version (acywatson) on 2025-02-21, but zurfyx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.24.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: acywatson → zurfyx (on 2025-02-07, known maintainer) provenance

This version was published by a different npm account (zurfyx) than the most recent previously approved version (acywatson) on 2025-02-07, but zurfyx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.23.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.23.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.22.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.21.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.20.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.19.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.18.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.17.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.17.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.3

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zurfyx → acywatson (on 2024-04-03, known maintainer) provenance

This version was published by a different npm account (acywatson) than the most recent previously approved version (zurfyx) on 2024-04-03, but acywatson is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.14.2

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zurfyx → acywatson (on 2024-03-18, known maintainer) provenance

This version was published by a different npm account (acywatson) than the most recent previously approved version (zurfyx) on 2024-03-18, but acywatson is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.14.1

2 findings
MEDIUM Publisher changed: zurfyx → ipavlov001 (on 2024-03-18, unremoved on npm for 855d) provenance

This version was published by a different npm account (ipavlov001) than the most recent previously approved version (zurfyx) on 2024-03-18. It has since remained available on npm for 855 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.14.0

2 findings
MEDIUM Publisher changed: zurfyx → ipavlov001 (on 2024-03-18, unremoved on npm for 855d) provenance

This version was published by a different npm account (ipavlov001) than the most recent previously approved version (zurfyx) on 2024-03-18. It has since remained available on npm for 855 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.13.1

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: acywatson → zurfyx (on 2024-01-26, known maintainer) provenance

This version was published by a different npm account (zurfyx) than the most recent previously approved version (acywatson) on 2024-01-26, but zurfyx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.13.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: acywatson → zurfyx (on 2024-01-24, known maintainer) provenance

This version was published by a different npm account (zurfyx) than the most recent previously approved version (acywatson) on 2024-01-24, but zurfyx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.12.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.5

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zurfyx → acywatson (on 2023-12-06, known maintainer) provenance

This version was published by a different npm account (acywatson) than the most recent previously approved version (zurfyx) on 2023-12-06, but acywatson is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.12.4

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: acywatson → zurfyx (on 2023-11-17, known maintainer) provenance

This version was published by a different npm account (zurfyx) than the most recent previously approved version (acywatson) on 2023-11-17, but zurfyx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.12.3

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zurfyx → acywatson (on 2023-11-17, known maintainer) provenance

This version was published by a different npm account (acywatson) than the most recent previously approved version (zurfyx) on 2023-11-17, but acywatson is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.12.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.1

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: acywatson → zurfyx (on 2023-09-08, known maintainer) provenance

This version was published by a different npm account (zurfyx) than the most recent previously approved version (acywatson) on 2023-09-08, but zurfyx is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.12.0

2 findings
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: zurfyx → acywatson (on 2023-08-10, known maintainer) provenance

This version was published by a different npm account (acywatson) than the most recent previously approved version (zurfyx) on 2023-08-10, but acywatson is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.11.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.8.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.5.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.