← Home

@lexical/html

npm Repository Homepage
4
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

fantactukazurfyxacywatsonipavlov001trueadmetrepum

Keywords

lexicaleditorrich-texthtml

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): Sibling in-monorepo package (lexical), not an external dependency. ai
maintainer-change maintainer-removed AI (maintainer-change): Same reshuffle; not a takeover given longevity and downloads. ai
maintainer-change maintainer-added AI (maintainer-change): Org-wide maintainer reshuffle on official Meta package, stable for 855+ days. ai
provenance publisher-changed-stale AI (provenance): Publisher change stale 855d without unpublish, consistent with legitimate transfer. ai
provenance publisher-changed AI (provenance): Transition from individual publisher to GitHub Actions CI/CD with SLSA provenance; stable for this package. ai
source-diff source-size-tripled AI (source-diff): Size growth from adding dev/prod/node build variants; normal for Lexical monorepo releases. ai
source-diff obfuscated-file:dist/LexicalHtml.prod.js AI (source-diff): Standard minified production bundle for this Meta-maintained package. ai
source-diff obfuscated-file:dist/LexicalHtml.prod.mjs AI (source-diff): Standard minified production ESM bundle for this Meta-maintained package. ai
provenance missing-githead AI (provenance): Established Facebook/Lexical package with clean metadata and no material code changes; missing gitHead likely reflects a CI pipeline change, not a supply chain compromise. ai
source-diff obfuscated-file:LexicalHtml.prod.js AI (source-diff): LexicalHtml.prod.js is a standard minified production build (long lines = minification, not obfuscation). This is Lexical's established dev/prod/node build pattern; stable false positive for this package. ai
source-diff obfuscated-file:LexicalHtml.prod.mjs AI (source-diff): LexicalHtml.prod.mjs is a standard minified ESM production build. Same reasoning as .prod.js — Lexical's documented build convention, not obfuscation. ai

Versions (showing 4 of 104)

Version Deps Published
0.3.3 0 / 0
0.3.2 0 / 0
0.3.1 0 / 0
0.3.0 0 / 0

v0.3.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.