@tryghost/helpers
Javascript Helpers for working with the Ghost [Content API](https://ghost.org/docs/content-api/)
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed-stale | AI (provenance): Publisher change is stale (2173d), inconsistent with takeover per rule description. | ai | |
| provenance | missing-githead | AI (provenance): Metadata-only regression from a trusted long-running publisher, no malicious code. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Known Ghost core team members, legitimate org maintainer rotation. | ai | |
| semgrep | semgrep:shady-links-exfil-services | AI (semgrep): URL is in a code comment, not executed; documentation reference only. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Normal maintainer rotation for long-lived official Ghost package. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation; consistent with TryGhost org's CI/CD migration. | ai |
Versions (showing 8 of 108)
| Version | Deps | Published |
|---|---|---|
| 1.1.5 | 1 / 11 | |
| 1.1.4 | 1 / 11 | |
| 1.1.3 | 1 / 11 | |
| 1.1.2 | 1 / 11 | |
| 1.1.1 | 1 / 11 | |
| 1.1.0 | 1 / 11 | |
| 1.0.1 | 1 / 9 | |
| 1.0.0 | 1 / 9 |
v1.1.5
3 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/c6f2c8a55eb350753454d0f84f34b1534be784c2/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-06-03, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.4
2 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/ac949a2e42df69d721fe52184564ca63709c0c60/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.3
3 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/f303041ad00ff3139dbbc610343d2eb689359dde/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-05-03, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.2
3 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/0e8fb27ff4291fec77fb2783d664f5a094a759b8/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (gargol) on 2019-04-17, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.1
3 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/56ac49beb9c80c0736470ee4eb6ce5faa65dea23/es/helpers.js#L4194 4192 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4193 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4194 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4195 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4196 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (rishabhgrg) than the most recent previously approved version (gargol) on 2019-04-15, but rishabhgrg is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.1.0
3 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) Source: https://github.com/TryGhost/Ghost-SDKs/tree/master/packages/helpers/blob/3e8a73b0d7e70e3b8dfe803fd7dc56428a42064b/es/helpers.js#L4196 4194 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 4195 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 4196 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 4197 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 4198 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (kevinansfield) than the most recent previously approved version (gargol) on 2019-03-14, but kevinansfield is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.