@pretextbook/web-editor
A web-based editor for PreTeXt documents, with simple preview functionality
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@pretextbook/latex-style-pretext | AI (dependencies): Same-org first-party package, low risk. | ai | |
| dependencies | unvetted-dep:@pretextbook/markdown-style-pretext | AI (dependencies): Same-org first-party package, low risk. | ai | |
| dependencies | unvetted-dep:@pretextbook/pretext-html | AI (dependencies): Same-org first-party dependency, consistent with monorepo pattern. | ai | |
| phantom-deps | phantom-dep:primereact | AI (phantom-deps): Config-referenced build dependency; stable for this package. | ai | |
| phantom-deps | phantom-dep:primeicons | AI (phantom-deps): Config-referenced build dependency; stable for this package. | ai | |
| phantom-deps | phantom-dep:primeflex | AI (phantom-deps): Config-referenced build dependency; stable for this package. | ai | |
| phantom-deps | phantom-dep:katex | AI (phantom-deps): Config-referenced build dependency; stable for this package. | ai | |
| phantom-deps | phantom-dep:@reduxjs/toolkit | AI (phantom-deps): Config-referenced build dependency; stable for this package. | ai | |
| phantom-deps | phantom-dep:@tiptap/react | AI (phantom-deps): Config-referenced build dependency; stable for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Diff shows no material change vs prior approved version despite file count. | ai | |
| provenance | publisher-changed | AI (provenance): Manual-to-CI/CD transition with SLSA attestation, not an account takeover signal. | ai | |
| phantom-deps | phantom-dep:constrained-editor-plugin | AI (phantom-deps): Config-file reference pattern; consistent with other accepted phantom deps in this package. | ai | |
| provenance | slsa-provenance | AI (provenance): Package consistently published via CI/CD with Sigstore attestation; stable supply chain signal. | ai | |
| dependencies | unvetted-dep:@pretextbook/remark-pretext | AI (dependencies): Same org scope (@pretextbook); consistent with the package's own namespace and ecosystem. | ai | |
| phantom-deps | phantom-dep:@pretextbook/remark-pretext | AI (phantom-deps): Same-org package; declared as runtime dep and likely re-exported rather than directly imported in analyzed entry points. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @dnd-kit/core, @dnd-kit/sortable, @dnd-kit/utilities are established, well-known drag-and-drop libraries with no malicious history. | ai | |
| dependencies | unvetted-dep:@pretextbook/format | AI (dependencies): Same org scope; legitimate first-party dependency for this PreTeXt editor package. | ai | |
| dependencies | unvetted-dep:@pretextbook/completions | AI (dependencies): Same org scope; legitimate first-party dependency for this PreTeXt editor package. | ai | |
| dependencies | unvetted-dep:@pretextbook/latex-pretext | AI (dependencies): Same org scope; legitimate first-party dependency for this PreTeXt editor package. | ai | |
| dependencies | unvetted-dep:xast-util-to-xml | AI (dependencies): Well-known unist/xast ecosystem utility; expected dependency for XML processing in a PreTeXt editor. | ai | |
| dependencies | unvetted-dep:xast-util-from-xml | AI (dependencies): Well-known unist/xast ecosystem utility; expected dependency for XML processing in a PreTeXt editor. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-hard-break | AI (phantom-deps): Build-time bundled library; phantom-dep heuristic fires on config-referenced deps, not a real import gap. | ai | |
| phantom-deps | phantom-dep:unist-util-visit | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@floating-ui/dom | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@dnd-kit/core | AI (phantom-deps): Bundled component library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:tailwindcss | AI (phantom-deps): CSS framework used via vite/build config, not direct import. Stable FP. | ai | |
| phantom-deps | phantom-dep:react-resizable-panels | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-text | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-list | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:hast-util-whitespace | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@monaco-editor/react | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@tiptap/pm | AI (phantom-deps): Bundled library; deps used via build config, not direct imports. Stable FP for this package. | ai | |
| phantom-deps | phantom-dep:xast-util-from-xml | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@tiptap/extensions | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@dnd-kit/utilities | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@tailwindcss/vite | AI (phantom-deps): Build tool plugin; used in vite config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@dnd-kit/sortable | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:xast-util-to-xml | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@pretextbook/completions | AI (phantom-deps): Same-org dep; bundled. Stable FP. | ai | |
| phantom-deps | phantom-dep:@pretextbook/latex-pretext | AI (phantom-deps): Same-org dep; bundled. Stable FP. | ai | |
| phantom-deps | phantom-dep:@tiptap/extension-code-block | AI (phantom-deps): Bundled library dep; referenced in config. Stable FP. | ai | |
| phantom-deps | phantom-dep:@pretextbook/format | AI (phantom-deps): Same-org dep; bundled. Stable FP. | ai |
Versions (showing 61 of 61)
| Version | Deps | Published |
|---|---|---|
| 0.17.0 | 17 / 21 | |
| 0.16.0 | 15 / 14 | |
| 0.14.1 | 14 / 14 | |
| 0.14.0 | 14 / 14 | |
| 0.13.0 | 14 / 14 | |
| 0.12.0 | 14 / 14 | |
| 0.11.2 | 14 / 14 | |
| 0.11.1 | 14 / 14 | |
| 0.11.0 | 14 / 14 | |
| 0.10.1 | 14 / 14 | |
| 0.10.0 | 14 / 14 | |
| 0.9.1 | 14 / 14 | |
| 0.9.0 | 14 / 14 | |
| 0.8.1 | 13 / 14 | |
| 0.8.0 | 13 / 14 | |
| 0.7.1 | 13 / 14 | |
| 0.7.0 | 13 / 14 | |
| 0.6.0 | 13 / 14 | |
| 0.5.4 | 13 / 14 | |
| 0.5.3 | 13 / 14 | |
| 0.5.2 | 13 / 14 | |
| 0.5.1 | 13 / 14 | |
| 0.4.2 | 13 / 14 | |
| 0.4.1 | 13 / 14 | |
| 0.4.0 | 13 / 14 | |
| 0.3.0 | 12 / 14 | |
| 0.2.0 | 12 / 14 | |
| 0.1.0 | 12 / 14 | |
| 0.0.34 | 12 / 14 | |
| 0.0.33 | 23 / 15 | |
| 0.0.32 | 23 / 15 | |
| 0.0.31 | 23 / 15 | |
| 0.0.30 | 23 / 15 | |
| 0.0.29 | 23 / 15 | |
| 0.0.28 | 23 / 15 | |
| 0.0.27 | 20 / 15 | |
| 0.0.26 | 20 / 15 | |
| 0.0.25 | 20 / 15 | |
| 0.0.24 | 20 / 15 | |
| 0.0.23 | 20 / 15 | |
| 0.0.22 | 20 / 15 | |
| 0.0.21 | 20 / 15 | |
| 0.0.20 | 19 / 15 | |
| 0.0.19 | 18 / 15 | |
| 0.0.18 | 18 / 15 | |
| 0.0.17 | 18 / 15 | |
| 0.0.16 | 21 / 15 | |
| 0.0.15 | 18 / 17 | |
| 0.0.14 | 23 / 13 | |
| 0.0.13 | 23 / 13 | |
| 0.0.12 | 23 / 13 | |
| 0.0.11 | 23 / 13 | |
| 0.0.10 | 23 / 13 | |
| 0.0.9 | 23 / 13 | |
| 0.0.8 | 23 / 13 | |
| 0.0.7 | 23 / 13 | |
| 0.0.6 | 23 / 13 | |
| 0.0.5 | 23 / 13 | |
| 0.0.4 | 23 / 13 | |
| 0.0.3 | 23 / 13 | |
| 0.0.2 | 23 / 13 |
v0.17.0
2 findingsThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. Multiple high-profile registry compromises have exhibited exactly this pattern.
This version was published by a different npm account (oscarlevin) than the most recent previously approved version (GitHub Actions) on 2026-07-25, but oscarlevin is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v0.16.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.14.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.14.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.13.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.11.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.11.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.21
2 findingsThis version was published by a different npm account than previous versions on 2026-03-12. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.20
2 findingsThis version was published by a different npm account than previous versions on 2026-03-06. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.19
2 findingsThis version was published by a different npm account than previous versions on 2026-03-03. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.18
2 findingsThis version was published by a different npm account than previous versions on 2026-03-02. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.17
2 findingsThis version was published by a different npm account than previous versions on 2026-03-01. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.16
2 findingsThis version was published by a different npm account than previous versions on 2026-02-28. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.15
2 findingsThis version was published by a different npm account than previous versions on 2026-02-28. This could indicate a legitimate maintainer transition or an account compromise.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.