@sps-woodland/rich-text-editor
SPS Design System rich text editor component
51
Versions
UNLICENSED
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
spsc_cafmacybuanjimthedevknedevspschrisndev
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lib/index-D2cePv6z.js | AI (source-diff): Minified vite bundle output with normal internal imports, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/index-B4K-bGMq.js | AI (source-diff): Vite-bundled output with hashed filename, no malicious behavior. | ai | |
| source-diff | obfuscated-file:lib/index-C7zTOoex.js | AI (source-diff): Vite-bundled first-party code, not true obfuscation; imports internal SPS packages. | ai | |
| source-diff | obfuscated-file:lib/index-8FMPfUmo.js | AI (source-diff): Vite/esbuild bundled output referencing internal packages, not true obfuscation. | ai | |
| source-diff | obfuscated-file:lib/index-CjMQhDG3.js | AI (source-diff): Vite/rollup bundle output, not true obfuscation; matches monorepo build pattern. | ai | |
| source-diff | obfuscated-file:lib/index-D2NsAnWS.js | AI (source-diff): Vite-bundled first-party imports, not obfuscation; consistent with build pipeline. | ai | |
| source-diff | obfuscated-file:lib/index-C0-Acs6O.js | AI (source-diff): Vite/Babel bundled build output, not obfuscation; imports first-party SPS packages. | ai | |
| source-diff | obfuscated-file:lib/index-CoXmqVK9.js | AI (source-diff): Bundled Vite build output with normal imports, not true obfuscation. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal design-system component, sparse README is normal for monorepo packages. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Expected from bundling new markdown-processing feature into single dist file. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Standard unified/remark/rehype markdown ecosystem libs for editor feature. | ai | |
| source-diff | obfuscated-file:lib/index-DUfGYdq1.js | AI (source-diff): Vite/esbuild bundle output referencing legit internal packages, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/index-CrCZYukE.js | AI (source-diff): Vite build output; readable imports confirm legitimate bundled React component, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/index-mwtWTZtq.js | AI (source-diff): Vite-hashed bundle output; sample shows plain React component code, not obfuscation. Pattern recurs across versions of this build-tool-based package. | ai | |
| source-diff | obfuscated-file:lib/index-C9vi4hTb.js | AI (source-diff): Vite build output; minified but not obfuscated — readable imports visible at file head. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:lib/index-CWfrZLjh.js | AI (source-diff): Standard Vite build output; long lines are minified bundle, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:lib/index-Dh9i9B_l.js | AI (source-diff): Vite-minified bundle for a React component; consistent pattern across this package's versions. | ai | |
| source-diff | obfuscated-file:lib/index-C5KKNt05.js | AI (source-diff): Vite build output; minified but readable React component code from the SPS woodland design system. | ai | |
| source-diff | obfuscated-file:lib/index-_7vZbbBA.js | AI (source-diff): Vite build output; long lines are minified bundle chunks, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:lib/index-CuDgjmya.js | AI (source-diff): Vite-bundled output with readable imports; minified line length, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:lib/index-C5PJE3OS.js | AI (source-diff): Standard Vite minified bundle output; readable imports confirm legitimate build artifact, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/index-DEoJY9vf.js | AI (source-diff): Vite build output; minified but readable imports confirm legitimate bundling pattern for this design system package. | ai | |
| source-diff | obfuscated-file:lib/index-GQbLxiWp.js | AI (source-diff): Standard Vite build output; minified but readable imports confirm legitimate bundling pattern for this package. | ai | |
| source-diff | obfuscated-file:lib/index-tCCJeGu9.js | AI (source-diff): Vite build output for a React component; minified but readable imports confirm legitimate bundled source. | ai | |
| phantom-deps | phantom-dep:remark-rehype | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:rehype-remark | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:rehype-parse | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:remark-parse | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:@spscommerce/i18n | AI (phantom-deps): Internal i18n dependency; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:unist-util-visit | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:remark-stringify | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:rehype-stringify | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai | |
| phantom-deps | phantom-dep:rehype-sanitize | AI (phantom-deps): Remark/rehype pipeline dependencies; used in config, not direct imports. | ai |
Versions (showing 51 of 237)
| Version | Deps | Published |
|---|---|---|
| 8.52.1 | 10 / 9 | |
| 8.52.0 | 10 / 9 | |
| 8.51.3 | 0 / 4 | |
| 8.51.2 | 0 / 4 | |
| 8.51.1 | 0 / 4 | |
| 8.51.0 | 0 / 4 | |
| 8.50.2 | 10 / 9 | |
| 8.50.1 | 10 / 9 | |
| 8.50.0 | 10 / 9 | |
| 8.49.0 | 10 / 9 | |
| 8.48.1 | 10 / 9 | |
| 8.48.0 | 10 / 9 | |
| 8.47.0 | 10 / 9 | |
| 8.46.7 | 10 / 9 | |
| 8.46.6 | 10 / 9 | |
| 8.46.5 | 10 / 9 | |
| 8.46.4 | 10 / 9 | |
| 8.46.3 | 10 / 9 | |
| 8.46.2 | 10 / 9 | |
| 8.46.1 | 10 / 9 | |
| 8.46.0 | 10 / 9 | |
| 8.45.8 | 10 / 9 | |
| 8.45.7 | 10 / 9 | |
| 8.45.6 | 10 / 9 | |
| 8.45.5 | 10 / 9 | |
| 8.45.4 | 10 / 9 | |
| 8.45.3 | 10 / 9 | |
| 8.45.2 | 10 / 9 | |
| 8.45.1 | 10 / 9 | |
| 8.45.0 | 10 / 9 | |
| 8.44.1 | 10 / 9 | |
| 8.44.0 | 10 / 9 | |
| 8.43.1 | 10 / 9 | |
| 8.43.0 | 10 / 9 | |
| 8.42.7 | 10 / 9 | |
| 8.42.6 | 10 / 9 | |
| 8.42.5 | 10 / 9 | |
| 8.42.4 | 10 / 9 | |
| 8.42.3 | 10 / 9 | |
| 8.42.2 | 10 / 9 | |
| 8.42.1 | 10 / 9 | |
| 8.42.0 | 10 / 9 | |
| 8.41.4 | 10 / 9 | |
| 8.41.3 | 10 / 9 | |
| 8.41.2 | 10 / 9 | |
| 8.41.1 | 10 / 9 | |
| 8.41.0 | 10 / 9 | |
| 8.40.0 | 10 / 9 | |
| 8.39.0 | 10 / 9 | |
| 8.38.2 | 10 / 9 | |
| 8.38.1 | 10 / 9 |
v8.52.1
2 findings
HIGH
New obfuscated file: lib/index-D2cePv6z.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.52.0
2 findings
HIGH
New obfuscated file: lib/index-DUfGYdq1.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.51.3
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.51.2
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.51.1
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.