@myst-theme/site
[](https://www.npmjs.com/package/@myst-theme/site) [](https://github.com/jupyter-book/myst-theme/blob/main/LICENS
4
Versions
MIT
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
gitHead linked
Maintainers
ebp-botrowanc1stevejpurvesagoose77
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:string.prototype.matchall | AI (phantom-deps): Same source-only package context; heuristic false positive. | ai | |
| phantom-deps | phantom-dep:thebe-react | AI (phantom-deps): Same source-only package context; heuristic false positive. | ai | |
| phantom-deps | phantom-dep:react-merge-refs | AI (phantom-deps): Same source-only package context; heuristic false positive. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Part of active myst-theme monorepo (117 versions); SLSA provenance confirms CI/CD publish from known org. | ai | |
| phantom-deps | phantom-dep:nbtx | AI (phantom-deps): Declared dep in a source-only package (main points to src/index.ts); phantom-dep heuristic unreliable here. | ai | |
| phantom-deps | phantom-dep:node-cache | AI (phantom-deps): Same source-only package context; heuristic false positive. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): Same source-only package context; heuristic false positive. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established monorepo package; sparse README is typical for internal workspace packages. | ai | |
| typosquat | typosquat.levenshtein:vite | AI (typosquat): Scoped package in the jupyter-book/myst-theme monorepo; not a typosquat of vite. | ai |