@tomsd/md-book
It provides .js that displays the contents from the markdown document files on page
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@tomsd/github-repo-js | AI (phantom-deps): Same-org dep likely used indirectly via bin entry; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:vue | AI (phantom-deps): Used in webpack-bundled Vue client; not directly imported in analyzed entry points. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): Used in bundled client code; phantom detection is a false positive for this build tool. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): Used in CLI bin; bundled output means direct import not visible to analyzer. | ai | |
| phantom-deps | phantom-dep:fast-glob | AI (phantom-deps): Used in bundled bin code; false positive for this package's build structure. | ai | |
| phantom-deps | phantom-dep:koa-router | AI (phantom-deps): Used in bundled server code; not directly imported in analyzed entry points. | ai | |
| phantom-deps | phantom-dep:koa | AI (phantom-deps): Used in bundled server code; not directly imported in analyzed entry points. | ai | |
| phantom-deps | phantom-dep:destyle.css | AI (phantom-deps): CSS dep used via webpack css-loader; not directly imported in JS entry points. | ai | |
| phantom-deps | phantom-dep:highlight.js | AI (phantom-deps): Used in bundled client code; false positive for this package's build structure. | ai | |
| phantom-deps | phantom-dep:koa-static-server | AI (phantom-deps): Used in bundled server code; not directly imported in analyzed entry points. | ai | |
| phantom-deps | phantom-dep:@tomsd/github-repo | AI (phantom-deps): Same-org dep used in bundled code; false positive for this package's build structure. | ai | |
| phantom-deps | phantom-dep:vue-router | AI (phantom-deps): Used in bundled Vue client; false positive for this package's build structure. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 2.1.0 | 11 / 18 | |
| 2.0.10 | 11 / 18 | |
| 2.0.9 | 11 / 18 | |
| 2.0.8 | 11 / 18 | |
| 2.0.7 | 11 / 18 | |
| 2.0.6 | 11 / 17 | |
| 2.0.5 | 11 / 16 | |
| 2.0.4 | 11 / 15 | |
| 2.0.3 | 11 / 15 | |
| 2.0.2 | 11 / 15 | |
| 2.0.1 | 11 / 15 | |
| 2.0.0 | 11 / 15 |
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.