@marko/compiler
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:jsesc | AI (phantom-deps): Config-file reference in established compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:resolve-from | AI (phantom-deps): Config-file reference in established compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:strip-ansi | AI (phantom-deps): Config-file reference in established compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:@babel/generator | AI (phantom-deps): Framework-scoped Babel package loaded by convention in compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:@babel/parser | AI (phantom-deps): Framework-scoped Babel package loaded by convention in compiler; stable pattern. | ai | |
| phantom-deps | phantom-dep:@babel/types | AI (phantom-deps): Framework-scoped Babel package loaded by convention in compiler; stable pattern. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): magic-string is a well-known, widely used string-manipulation dep for compilers. | ai | |
| provenance | missing-githead | AI (provenance): CI metadata gap, offset by SLSA attestation and unchanged provenance direction. | ai | |
| source-diff | net-exec-file:dist/babel.web.js | AI (source-diff): False positive — bundled Babel code triggers net+exec heuristic. No actual malicious network or execution patterns in the sample. | ai | |
| source-diff | obfuscated-file:dist/babel.web.js | AI (source-diff): dist/babel.web.js is a bundled browser-targeted build artifact. Long lines are from bundling, not obfuscation. Expected for a compiler package. | ai | |
| source-diff | net-exec-file:dist/babel.js | AI (source-diff): False positive: Babel's code generation uses Function constructors internally; no actual malicious network+exec pattern. This is bundled Babel source code. | ai | |
| source-diff | obfuscated-file:dist/babel.js | AI (source-diff): dist/babel.js is an esbuild bundle of @babel/* deps (which were removed from runtime deps). Long lines are standard bundler output, not obfuscation. Stable architectural pattern for this package. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by bundling all @babel/* runtime deps into dist/babel.js, which were simultaneously removed from package dependencies. Expected architectural change. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed from dylanpiercey to GitHub Actions CI/CD — a legitimate and recommended security improvement for the marko-js/marko monorepo, backed by SLSA provenance attestation. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Apparent dormancy is an artifact of the publisher account change (personal → GitHub Actions). Package has 368 versions and active ecosystem use; not a genuine dormancy signal. | ai | |
| phantom-deps | phantom-dep:@babel/plugin-syntax-typescript | AI (phantom-deps): Framework-scoped Babel plugin loaded by convention in the Marko compiler; not a direct import but a legitimate peer/convention dependency. | ai | |
| dependencies | unvetted-dep:htmljs-parser | AI (dependencies): htmljs-parser is a core Marko ecosystem parser maintained by the same marko-js org; stable legitimate dependency. | ai | |
| phantom-deps | phantom-dep:self-closing-tags | AI (phantom-deps): self-closing-tags is a declared runtime dependency; phantom detection reflects config-file-only reference, not a security issue. | ai | |
| phantom-deps | phantom-dep:complain | AI (phantom-deps): complain is a declared runtime dependency; phantom detection reflects config-file-only reference, not a security issue. | ai | |
| phantom-deps | phantom-dep:he | AI (phantom-deps): he is a declared runtime dependency; phantom detection reflects config-file-only reference, not a security issue. | ai | |
| dependencies | unvetted-dep:@luxass/strip-json-comments | AI (dependencies): Strip-json-comments utility; no security concerns for this compiler package context. | ai | |
| dependencies | unvetted-dep:complain | AI (dependencies): complain is a well-known deprecation warning utility with a long history; no security concerns. | ai | |
| dependencies | unvetted-dep:relative-import-path | AI (dependencies): relative-import-path is a small Marko ecosystem utility; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:self-closing-tags | AI (dependencies): self-closing-tags is a small Marko ecosystem utility; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:lasso-package-root | AI (dependencies): lasso-package-root is part of the eBay Lasso/Marko ecosystem; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:raptor-regexp | AI (dependencies): raptor-regexp is a long-standing eBay/Marko ecosystem utility package; stable legitimate dependency. | ai | |
| dependencies | unvetted-dep:raptor-util | AI (dependencies): raptor-util is a long-standing eBay/Marko ecosystem utility package; stable legitimate dependency. | ai |
Versions (showing 100 of 294)
| Version | Deps | Published |
|---|---|---|
| 5.37.12 | 23 / 1 | |
| 5.37.11 | 23 / 1 | |
| 5.37.10 | 23 / 1 | |
| 5.37.9 | 23 / 1 | |
| 5.37.8 | 23 / 1 | |
| 5.37.7 | 23 / 1 | |
| 5.37.6 | 23 / 1 | |
| 5.37.5 | 23 / 1 | |
| 5.37.4 | 23 / 1 | |
| 5.37.3 | 23 / 1 | |
| 5.37.2 | 23 / 1 | |
| 5.37.1 | 23 / 1 | |
| 5.37.0 | 23 / 1 | |
| 5.36.2 | 23 / 1 | |
| 5.36.1 | 23 / 1 | |
| 5.36.0 | 23 / 1 | |
| 5.35.14 | 23 / 1 | |
| 5.35.13 | 23 / 1 | |
| 5.35.12 | 23 / 1 | |
| 5.35.11 | 23 / 1 | |
| 5.35.10 | 23 / 1 | |
| 5.35.9 | 23 / 1 | |
| 5.35.8 | 23 / 1 | |
| 5.35.7 | 23 / 1 | |
| 5.35.6 | 23 / 1 | |
| 5.35.5 | 23 / 1 | |
| 5.35.4 | 23 / 1 | |
| 5.35.3 | 23 / 1 | |
| 5.35.2 | 23 / 1 | |
| 5.35.1 | 23 / 1 | |
| 5.35.0 | 23 / 1 | |
| 5.34.7 | 23 / 1 | |
| 5.34.6 | 23 / 1 | |
| 5.34.5 | 23 / 1 | |
| 5.34.4 | 23 / 1 | |
| 5.34.3 | 24 / 1 | |
| 5.34.2 | 24 / 1 | |
| 5.34.1 | 24 / 1 | |
| 5.34.0 | 24 / 1 | |
| 5.33.8 | 24 / 1 | |
| 5.33.7 | 24 / 1 | |
| 5.33.6 | 24 / 1 | |
| 5.33.5 | 24 / 1 | |
| 5.33.4 | 24 / 1 | |
| 5.33.3 | 24 / 1 | |
| 5.33.2 | 24 / 1 | |
| 5.33.1 | 24 / 1 | |
| 5.33.0 | 24 / 1 | |
| 5.32.0 | 24 / 1 | |
| 5.31.2 | 24 / 1 | |
| 5.31.1 | 24 / 1 | |
| 5.31.0 | 23 / 1 | |
| 5.30.3 | 23 / 1 | |
| 5.30.2 | 23 / 1 | |
| 5.30.1 | 23 / 1 | |
| 5.30.0 | 23 / 1 | |
| 5.29.0 | 23 / 1 | |
| 5.28.5 | 23 / 1 | |
| 5.28.4 | 23 / 1 | |
| 5.28.3 | 23 / 1 | |
| 5.28.2 | 23 / 1 | |
| 5.28.1 | 23 / 1 | |
| 5.28.0 | 23 / 1 | |
| 5.27.10 | 22 / 1 | |
| 5.27.9 | 22 / 1 | |
| 5.27.8 | 22 / 1 | |
| 5.27.7 | 22 / 1 | |
| 5.27.6 | 22 / 1 | |
| 5.27.5 | 22 / 1 | |
| 5.27.4 | 22 / 1 | |
| 5.27.3 | 22 / 1 | |
| 5.27.2 | 22 / 1 | |
| 5.27.1 | 22 / 1 | |
| 5.27.0 | 22 / 1 | |
| 5.26.0 | 22 / 1 | |
| 5.25.0 | 22 / 1 | |
| 5.24.0 | 23 / 1 | |
| 5.23.6 | 23 / 1 | |
| 5.23.5 | 23 / 1 | |
| 5.23.4 | 23 / 1 | |
| 5.23.3 | 23 / 1 | |
| 5.23.2 | 23 / 1 | |
| 5.23.1 | 23 / 1 | |
| 5.23.0 | 23 / 1 | |
| 5.22.10 | 23 / 1 | |
| 5.22.9 | 23 / 1 | |
| 5.22.8 | 23 / 1 | |
| 5.22.7 | 23 / 1 | |
| 5.22.6 | 23 / 1 | |
| 5.22.5 | 23 / 1 | |
| 5.22.4 | 23 / 1 | |
| 5.22.3 | 23 / 1 | |
| 5.22.2 | 23 / 1 | |
| 5.22.1 | 23 / 1 | |
| 5.22.0 | 23 / 1 | |
| 5.21.7 | 21 / 1 | |
| 5.21.6 | 21 / 1 | |
| 5.21.5 | 21 / 1 | |
| 5.21.4 | 21 / 1 | |
| 5.21.3 | 21 / 1 |
v5.37.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.36.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.36.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.36.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.35.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.34.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.33.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.32.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.31.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.31.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.31.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.30.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.30.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.30.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.30.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.29.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.28.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.28.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.28.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.28.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.28.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.28.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.27.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.26.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.25.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.24.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.23.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.22.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.21.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.