@redocly/redoc — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

romanhotsiyalawaradamaltmanmarshevskyyvolodymyr-rutskyislavikbezkorovainyi

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	obfuscated-file:dist/constants/l10n/langs/ar.js	AI (source-diff): Localization JSON strings escaped to \u, not code obfuscation.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/constants/plugins/catalog-entities.js	AI (source-diff): Minified constants file, plain config object.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/plugins/catalog-entities/database/catalog-entities-service.js	AI (source-diff): Minified service glue code, no malicious behavior.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/plugins/catalog-entities/database/repositories/remote/catalog-entities-remote-repository.js	AI (source-diff): Minified DB repository code; env vars used for user-configured sync DB, not exfil.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/plugins/catalog-entities/database/repositories/local/catalog-entities-local-read-repository.js	AI (source-diff): Minified drizzle-orm DB repository code, legitimate feature code.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/plugins/catalog-entities/extensions/extractors/api-description/asyncapi-entities-extractor.js	AI (source-diff): esbuild-minified build output; no malicious behavior in sample.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/plugins/catalog-entities/extensions/extractors/api-description/arazzo-entities-extractor.js	AI (source-diff): esbuild-minified build output per package.json build:minify script.	ai	2026/07/16
source-diff	obfuscated-file:dist/server/persistence/kv/repositories/kv-repository.js	AI (source-diff): Minified build output, no malicious behavior present.	ai	2026/07/14
source-diff	obfuscated-file:dist/server/web-server/routes/mcp-routes/mcp-oauth.js	AI (source-diff): Minified OAuth route code, standard bundler output.	ai	2026/07/14
source-diff	obfuscated-file:dist/server/plugins/catalog-entities/database/catalog-entities-publisher.js	AI (source-diff): Minified build output from legit monorepo, not injected obfuscation.	ai	2026/07/14
dependencies	unvetted-dep:yaml-ast-parser	AI (dependencies): Long-standing legitimate YAML parsing dep for OpenAPI tooling.	ai	2026/07/14
phantom-deps	phantom-dep:openapi-sampler	AI (phantom-deps): Used indirectly via build config, not a direct import.	ai	2026/07/14
phantom-deps	phantom-dep:xpath	AI (phantom-deps): Large monorepo config-referenced dep, stable false positive.	ai	2026/07/14
source-diff	obfuscated-file:dist/server/plugins/mcp/docs-mcp/tools/graphql/utils.js	AI (source-diff): Minified esbuild bundler output, not true obfuscation; no malicious behavior present.	ai	2026/07/14
dependencies	unvetted-dep:@redocly/mcp-typescript-sdk	AI (dependencies): First-party Redocly-scoped package	ai	2026/07/08
phantom-deps	phantom-dep:dotenv	AI (phantom-deps): Monorepo config-referenced dep, stable FP pattern for this package.	ai	2026/07/08
phantom-deps	phantom-dep:anser	AI (phantom-deps): Monorepo config-referenced dep, stable FP pattern for this package.	ai	2026/07/08
bogus-package	bogus-package	AI (bogus-package): Spam heuristics don't apply to this long-established, widely-used package.	ai	2026/07/08
phantom-deps	phantom-dep:ulid	AI (phantom-deps): Large monorepo package; config-referenced deps are expected false positives.	ai	2026/07/08
npm-metadata	no-description	AI (npm-metadata): Cosmetic metadata gap on an established, trusted package.	ai	2026/07/08
source-diff	large-new-source-files	AI (source-diff): Large first-party server codebase (catalog/MCP); expected growth for this package.	ai	2026/07/08
publish-pattern	new-deps-added	AI (publish-pattern): @emotion/is-prop-valid is standard styled-components helper; benign.	ai	2026/07/08
typosquat	typosquat.levenshtein:redis	AI (typosquat): @redocly/redoc is a well-known scoped package from the Redocly org; not a typosquat of redis.	ai	2026/04/30
phantom-deps	phantom-dep:@redocly/portal-plugin-mock-server	AI (phantom-deps): Same-org plugin dependency; phantom-dep heuristic false positive for this package.	ai	2026/04/30
phantom-deps	phantom-dep:react-dom	AI (phantom-deps): react-dom is a peer dependency declared in peerDependencies; phantom-dep heuristic false positive.	ai	2026/04/30
typosquat	typosquat.levenshtein:redux	AI (typosquat): @redocly/redoc is a well-known scoped package from the Redocly org; not a typosquat of redux.	ai	2026/04/30

Versions (showing 19 of 19)

Version	Deps	Published
0.135.0	87 / 0	2026-07-08
0.134.0	85 / 0	2026-06-09
0.133.1	84 / 0	2026-05-29
0.132.1	84 / 0	2026-04-28
0.131.3	85 / 0	2026-04-07
0.131.1	85 / 0	2026-03-20
0.130.4	84 / 0	2026-02-20
0.130.3	84 / 0	2026-02-19
0.130.0	84 / 0	2026-02-10
0.129.2	87 / 0	2026-01-16
0.128.1	86 / 0	2025-12-22
0.128.0	86 / 0	2025-12-09
0.127.0	86 / 0	2025-11-06
0.123.0	83 / 0	2025-07-03
0.122.3	82 / 0	2025-06-23
0.122.2	82 / 0	2025-06-19
0.122.0	82 / 0	2025-06-10
0.121.1	80 / 0	2025-05-06
0.85.0	66 / 0	2024-06-10

v0.135.0

2 findings

HIGH New obfuscated file: dist/server/plugins/mcp/docs-mcp/tools/graphql/utils.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.134.0

7 findings

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/catalog-entities-publisher.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/entities/entities-read-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/entities/entities-write-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/web-server/routes/mcp-routes/mcp-oauth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/relations/relations-read-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/remote-publish-lock-service.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.133.1

7 findings

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/catalog-entities-publisher.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/entities/entities-read-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/entities/entities-write-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/persistence/kv/repositories/kv-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/web-server/routes/mcp-routes/mcp-oauth.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/relations/relations-read-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.131.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.130.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.130.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.130.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.129.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.128.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.128.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.127.0

8 findings

HIGH New obfuscated file: dist/constants/l10n/langs/ar.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/extensions/extractors/api-description/arazzo-entities-extractor.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/extensions/extractors/api-description/asyncapi-entities-extractor.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/local/catalog-entities-local-read-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/repositories/remote/catalog-entities-remote-repository.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/plugins/catalog-entities/database/catalog-entities-service.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/server/constants/plugins/catalog-entities.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.123.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.122.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.122.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.122.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.121.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.85.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.