@redocly/revel
Revel is Redocly's external developer showcase platform that transforms your API into a branded experience.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:xml-crypto | AI (phantom-deps): Large monorepo package; XML crypto used for SAML/XML entity features, likely dynamic import. | ai | |
| source-diff | bulk-obfuscated-files:dist | AI (source-diff): esbuild-minified dist output per package.json build:minify script, not true obfuscation. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/api | AI (phantom-deps): Telemetry stack consistently declared across many OTel packages; used via instrumentation setup. | ai | |
| phantom-deps | phantom-dep:copy-to-clipboard | AI (phantom-deps): UI utility likely used in bundled frontend code. | ai | |
| phantom-deps | phantom-dep:path-browserify | AI (phantom-deps): Browserify shim polyfill, bundler-resolved. | ai | |
| phantom-deps | phantom-dep:escape-carriage | AI (phantom-deps): Small utility likely used transitively/bundled. | ai | |
| phantom-deps | phantom-dep:tty-browserify | AI (phantom-deps): Browserify shim, bundler-resolved polyfill not directly imported. | ai | |
| phantom-deps | phantom-dep:@xmldom/xmldom | AI (phantom-deps): Supporting dep for xml-crypto/xpath XML parsing chain. | ai | |
| phantom-deps | phantom-dep:react-dom | AI (phantom-deps): Peer dep for UI package. | ai | |
| phantom-deps | phantom-dep:buffer | AI (phantom-deps): Monorepo build tool; deps used via config/build pipeline not direct import. | ai | |
| phantom-deps | phantom-dep:events | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:graphql | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:is-glob | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:sitemap | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): Used by post-build script via loader. | ai | |
| phantom-deps | phantom-dep:enquirer | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:mustache | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:lru-cache | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:minimatch | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:nprogress | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:web-vitals | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:gray-matter | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:htmlparser2 | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:stream-http | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:react-helmet | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:react-select | AI (phantom-deps): Same as above. | ai | |
| phantom-deps | phantom-dep:os-browserify | AI (phantom-deps): Same as above. | ai | |
| source-diff | obfuscated-file:dist/constants/l10n/langs/ar.js | AI (source-diff): Minified build output from documented esbuild-minify step, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/catalog-entities/extensions/extractors/api-description/arazzo-entities-extractor.js | AI (source-diff): Bundled/minified server code, matches package's own build pipeline. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Consistent with Redocly org's normal team rotation across 462 versions. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Consistent with Redocly org's normal team rotation across 462 versions. | ai | |
| dependencies | unvetted-dep:@redocly/mcp-typescript-sdk | AI (dependencies): Same-org scoped package, benign. | ai | |
| phantom-deps | phantom-dep:openapi-sampler | AI (phantom-deps): New dep used via config/build tooling, common in this monorepo pattern. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): Framework-scoped, loaded by convention. | ai | |
| phantom-deps | phantom-dep:@redocly/portal-plugin-mock-server | AI (phantom-deps): Same-org scoped package, expected. | ai | |
| phantom-deps | phantom-dep:xpath | AI (phantom-deps): Same pattern as other phantom deps in this build-tooling package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established Redocly org package; missing description/repo is metadata hygiene, not spam. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Expected growth from new MCP tooling subsystem, not injected code. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/mcp/docs-mcp/tools/graphql/utils.js | AI (source-diff): Minified esbuild bundle output, matches package's own build:minify script. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Large monorepo package; deps referenced via config/dynamic imports. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/catalog-entities/database/catalog-entities-publisher.js | AI (source-diff): Minified ESM output from esbuild build pipeline; readable business logic, no malware indicators. | ai | |
| phantom-deps | phantom-dep:anser | AI (phantom-deps): Large monorepo package; deps referenced via config/dynamic imports. | ai | |
| phantom-deps | phantom-dep:ulid | AI (phantom-deps): Large monorepo package; deps referenced via config/dynamic imports, not direct static imports. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/catalog-entities/database/remote-publish-lock-service.js | AI (source-diff): Minified ESM output from esbuild build pipeline; readable distributed lock implementation. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/catalog-entities/database/repositories/relations/relations-read-repository.js | AI (source-diff): Minified ESM output from esbuild build pipeline; readable drizzle-orm query logic. | ai | |
| source-diff | obfuscated-file:dist/server/web-server/routes/mcp-routes/mcp-oauth.js | AI (source-diff): Minified ESM output from esbuild; readable MCP OAuth implementation using standard crypto/JWT. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/catalog-entities/database/repositories/entities/entities-write-repository.js | AI (source-diff): Minified ESM output from esbuild build pipeline; readable drizzle-orm write logic. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): Large monorepo package; deps referenced via config/dynamic imports. | ai | |
| phantom-deps | phantom-dep:nanoid | AI (phantom-deps): Large monorepo package; deps referenced via config/dynamic imports. | ai | |
| phantom-deps | phantom-dep:@emotion/is-prop-valid | AI (phantom-deps): Newly added dep; used transitively by styled-components, referenced in config. | ai | |
| phantom-deps | phantom-dep:fflate | AI (phantom-deps): Large monorepo package; deps referenced via config/dynamic imports. | ai | |
| source-diff | obfuscated-file:dist/server/plugins/catalog-entities/database/repositories/entities/entities-read-repository.js | AI (source-diff): Minified ESM output from esbuild build pipeline; readable drizzle-orm query logic. | ai |
Versions (showing 31 of 31)
| Version | Deps | Published |
|---|---|---|
| 0.135.0 | 87 / 0 | |
| 0.134.0 | 85 / 0 | |
| 0.132.1 | 84 / 0 | |
| 0.131.3 | 85 / 0 | |
| 0.130.3 | 84 / 0 | |
| 0.129.1 | 87 / 0 | |
| 0.129.0 | 87 / 0 | |
| 0.128.0 | 86 / 0 | |
| 0.127.0 | 86 / 0 | |
| 0.123.1 | 83 / 0 | |
| 0.123.0 | 83 / 0 | |
| 0.122.3 | 82 / 0 | |
| 0.122.2 | 82 / 0 | |
| 0.122.1 | 82 / 0 | |
| 0.122.0 | 82 / 0 | |
| 0.121.1 | 80 / 0 | |
| 0.99.0 | 60 / 0 | |
| 0.97.3 | 66 / 0 | |
| 0.97.0 | 66 / 0 | |
| 0.95.0 | 66 / 0 | |
| 0.94.0 | 66 / 0 | |
| 0.93.3 | 66 / 0 | |
| 0.93.1 | 66 / 0 | |
| 0.92.5 | 66 / 0 | |
| 0.92.3 | 66 / 0 | |
| 0.92.0 | 66 / 0 | |
| 0.91.5 | 66 / 0 | |
| 0.91.2 | 66 / 0 | |
| 0.90.0 | 66 / 0 | |
| 0.89.0 | 66 / 0 | |
| 0.84.0 | 66 / 0 |
v0.135.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.129.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.127.0
10 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.123.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.123.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.99.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.92.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.92.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.92.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.91.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.91.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.90.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.89.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.84.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.