@redocly/openapi-docs — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

romanhotsiyalawaradamaltmanmarshevskyyvolodymyr-rutskyislavikbezkorovainyi

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Publisher shifted to GitHub Actions CI, consistent with legitimate CI/CD publishing.	ai	2026/07/16
bogus-package	bogus-package	AI (bogus-package): Established Redocly package; missing README/repo metadata is a packaging quirk, not spam.	ai	2026/07/16
maintainer-change	maintainer-added	AI (maintainer-change): Publisher has strong track record; consistent with legitimate Redocly team transition.	ai	2026/07/16
publish-pattern	new-deps-added	AI (publish-pattern): web-vitals is a well-known, benign Google metrics library.	ai	2026/07/16
phantom-deps	phantom-dep:prismjs	AI (phantom-deps): Used via config/highlighting, not direct import; long-standing pattern.	ai	2026/07/16
source-diff	obfuscated-file:lib/services/code-samples/httpsnippet/helpers/device-auth-snippets.js	AI (source-diff): Minified but fully readable OAuth2 device-flow code generation; no malicious patterns present.	ai	2026/05/27
source-diff	encoded-string-file:dist/redocly-openapi-docs.min.js	AI (source-diff): Minified bundle; encoded strings are normal build output for this package.	ai	2026/05/15
phantom-deps	phantom-dep:tslib	AI (phantom-deps): Known implicit runtime dependency; stable for this package.	ai	2026/05/12
phantom-deps	phantom-dep:path-browserify	AI (phantom-deps): Config-referenced dependency; stable pattern for this package.	ai	2026/05/12
phantom-deps	phantom-dep:jstoxml	AI (phantom-deps): Config-referenced dependency; stable pattern for this package.	ai	2026/05/12
phantom-deps	phantom-dep:swagger2openapi	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
semgrep	semgrep:shady-links-raw-ip	AI (semgrep): False positive on minified JSX bundle; no actual raw IP URL present in the sample.	ai	2026/04/30
phantom-deps	phantom-dep:@redocly/openapi-core	AI (phantom-deps): Same-org scoped package; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:stringify-object	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:util	AI (phantom-deps): Declared dep used in config/build context; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:slugify	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:deepmerge	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:dompurify	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:web-vitals	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:json-pointer	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:url-template	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:fast-deep-equal	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30
phantom-deps	phantom-dep:fast-xml-parser	AI (phantom-deps): Declared dep; phantom-dep heuristic misfires on bundled output.	ai	2026/04/30