@marko/compiler
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:jsesc | AI (phantom-deps): Config-file reference in established compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:resolve-from | AI (phantom-deps): Config-file reference in established compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:strip-ansi | AI (phantom-deps): Config-file reference in established compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:@babel/generator | AI (phantom-deps): Framework-scoped Babel package loaded by convention in compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:@babel/parser | AI (phantom-deps): Framework-scoped Babel package loaded by convention in compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:@babel/types | AI (phantom-deps): Framework-scoped Babel package loaded by convention in compiler; stable pattern. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): magic-string is a well-known, widely used string-manipulation dep for compilers. | ai | |
| provenance | missing-githead | AI (provenance): CI metadata gap, offset by SLSA attestation and unchanged provenance direction. | ai | |
| source-diff | net-exec-file:dist/babel.web.js | AI (source-diff): False positive — bundled Babel code triggers net+exec heuristic. No actual malicious network or execution patterns in the sample. | ai | |
| source-diff | obfuscated-file:dist/babel.web.js | AI (source-diff): dist/babel.web.js is a bundled browser-targeted build artifact. Long lines are from bundling, not obfuscation. Expected for a compiler package. | ai | |
| source-diff | net-exec-file:dist/babel.js | AI (source-diff): False positive: Babel's code generation uses Function constructors internally; no actual malicious network+exec pattern. This is bundled Babel source code. | ai | |
| source-diff | obfuscated-file:dist/babel.js | AI (source-diff): dist/babel.js is an esbuild bundle of @babel/* deps (which were removed from runtime deps). Long lines are standard bundler output, not obfuscation. Stable architectural pattern for this package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by bundling all @babel/* runtime deps into dist/babel.js, which were simultaneously removed from package dependencies. Expected architectural change. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed from dylanpiercey to GitHub Actions CI/CD — a legitimate and recommended security improvement for the marko-js/marko monorepo, backed by SLSA provenance attestation. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Apparent dormancy is an artifact of the publisher account change (personal → GitHub Actions). Package has 368 versions and active ecosystem use; not a genuine dormancy signal. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-syntax-typescript | AI (phantom-deps): Framework-scoped Babel plugin loaded by convention in the Marko compiler; not a direct import but a legitimate peer/convention dependency. | ai | |
| dependencies | unvetted-dep:htmljs-parser | AI (dependencies): htmljs-parser is a core Marko ecosystem parser maintained by the same marko-js org; stable legitimate dependency. | ai | |
| phantom-deps | phantom-dep:self-closing-tags | AI (phantom-deps): self-closing-tags is a declared runtime dependency; phantom detection reflects config-file-only reference, not a security issue. | ai | |
| phantom-deps | phantom-dep:complain | AI (phantom-deps): complain is a declared runtime dependency; phantom detection reflects config-file-only reference, not a security issue. | ai | |
| phantom-deps | phantom-dep:he | AI (phantom-deps): he is a declared runtime dependency; phantom detection reflects config-file-only reference, not a security issue. | ai | |
| dependencies | unvetted-dep:@luxass/strip-json-comments | AI (dependencies): Strip-json-comments utility; no security concerns for this compiler package context. | ai | |
| dependencies | unvetted-dep:complain | AI (dependencies): complain is a well-known deprecation warning utility with a long history; no security concerns. | ai | |
| dependencies | unvetted-dep:relative-import-path | AI (dependencies): relative-import-path is a small Marko ecosystem utility; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:self-closing-tags | AI (dependencies): self-closing-tags is a small Marko ecosystem utility; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:lasso-package-root | AI (dependencies): lasso-package-root is part of the eBay Lasso/Marko ecosystem; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:raptor-regexp | AI (dependencies): raptor-regexp is a long-standing eBay/Marko ecosystem utility package; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:raptor-util | AI (dependencies): raptor-util is a long-standing eBay/Marko ecosystem utility package; stable legitimate dependency. | ai |
Versions (showing 93 of 295)
| Version | Deps | Published |
|---|---|---|
| 5.21.2 | 21 / 1 | |
| 5.21.1 | 21 / 1 | |
| 5.21.0 | 21 / 1 | |
| 5.20.9 | 21 / 1 | |
| 5.20.8 | 21 / 1 | |
| 5.20.7 | 21 / 1 | |
| 5.20.6 | 21 / 1 | |
| 5.20.5 | 21 / 1 | |
| 5.20.4 | 21 / 1 | |
| 5.20.3 | 21 / 1 | |
| 5.20.2 | 22 / 1 | |
| 5.20.0 | 22 / 1 | |
| 5.19.1 | 22 / 1 | |
| 5.19.0 | 22 / 1 | |
| 5.18.2 | 22 / 1 | |
| 5.18.1 | 22 / 1 | |
| 5.18.0 | 22 / 1 | |
| 5.17.10 | 22 / 1 | |
| 5.17.6 | 22 / 1 | |
| 5.17.4 | 22 / 1 | |
| 5.17.3 | 22 / 1 | |
| 5.16.1 | 22 / 1 | |
| 5.16.0 | 22 / 1 | |
| 5.15.11 | 22 / 1 | |
| 5.15.10 | 22 / 1 | |
| 5.15.9 | 22 / 1 | |
| 5.15.8 | 22 / 1 | |
| 5.15.7 | 22 / 1 | |
| 5.15.6 | 22 / 1 | |
| 5.15.4 | 22 / 1 | |
| 5.15.3 | 22 / 1 | |
| 5.15.2 | 22 / 1 | |
| 5.15.0 | 22 / 1 | |
| 5.14.2 | 22 / 1 | |
| 5.14.1 | 22 / 1 | |
| 5.14.0 | 22 / 1 | |
| 5.13.0 | 22 / 1 | |
| 5.12.1 | 22 / 1 | |
| 5.12.0 | 22 / 1 | |
| 5.11.3 | 22 / 1 | |
| 5.11.2 | 22 / 1 | |
| 5.11.1 | 22 / 1 | |
| 5.11.0 | 22 / 1 | |
| 5.10.7 | 22 / 1 | |
| 5.10.6 | 22 / 1 | |
| 5.10.5 | 22 / 1 | |
| 5.10.2 | 22 / 1 | |
| 5.10.1 | 22 / 1 | |
| 5.10.0 | 22 / 1 | |
| 5.9.0 | 22 / 1 | |
| 5.8.4 | 22 / 1 | |
| 5.8.3 | 22 / 1 | |
| 5.8.2 | 22 / 1 | |
| 5.8.1 | 22 / 1 | |
| 5.8.0 | 22 / 1 | |
| 5.7.0 | 22 / 1 | |
| 5.6.2 | 22 / 1 | |
| 5.6.1 | 22 / 1 | |
| 5.6.0 | 22 / 1 | |
| 5.5.4 | 22 / 1 | |
| 5.5.3 | 22 / 1 | |
| 5.5.2 | 22 / 1 | |
| 5.5.1 | 22 / 1 | |
| 5.5.0 | 22 / 1 | |
| 5.4.2 | 23 / 1 | |
| 5.4.1 | 23 / 1 | |
| 5.4.0 | 23 / 1 | |
| 5.2.2 | 23 / 1 | |
| 5.2.1 | 19 / 1 | |
| 5.2.0 | 18 / 1 | |
| 5.1.21 | 18 / 2 | |
| 5.1.20 | 18 / 2 | |
| 5.1.19 | 18 / 2 | |
| 5.1.18 | 19 / 2 | |
| 5.1.17 | 19 / 2 | |
| 5.1.16 | 19 / 2 | |
| 5.1.15 | 19 / 2 | |
| 5.1.14 | 19 / 2 | |
| 5.1.13 | 19 / 2 | |
| 5.1.12 | 19 / 2 | |
| 5.1.11 | 19 / 2 | |
| 5.1.10 | 19 / 2 | |
| 5.1.9 | 19 / 2 | |
| 5.1.8 | 19 / 2 | |
| 5.1.7 | 19 / 2 | |
| 5.1.6 | 19 / 2 | |
| 5.1.5 | 19 / 2 | |
| 5.1.4 | 19 / 2 | |
| 5.1.3 | 19 / 2 | |
| 5.1.2 | 19 / 2 | |
| 5.1.1 | 19 / 2 | |
| 5.1.0 | 19 / 2 | |
| 5.0.0 | 19 / 2 |
v5.21.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.20.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.19.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.19.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.18.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.18.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.17.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.17.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.17.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.17.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.16.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.16.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.15.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.14.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.14.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.14.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.13.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.12.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.12.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.11.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.10.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.10.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.10.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.10.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.10.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.10.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.6.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.2.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.2.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.