@wangeditor-next/editor
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Established editor package with clean history; missing gitHead is a CI/publish process change, not a security signal. | ai | |
| source-diff | obfuscated-file:dist/upload.js | AI (source-diff): Standard minified UMD bundle with Uppy upload integration; expected build artifact. | ai | |
| source-diff | obfuscated-file:dist/upload.mjs | AI (source-diff): Standard minified ESM bundle; expected build artifact. | ai | |
| source-diff | net-exec-file:dist/core.js | AI (source-diff): Network calls are editor fetch/XHR; dynamic code execution is standard UMD wrapper pattern. | ai | |
| source-diff | net-exec-file:dist/core.mjs | AI (source-diff): Same as core.js — UMD/ESM wrapper with editor network functionality. | ai | |
| source-diff | net-exec-file:dist/upload.js | AI (source-diff): Uppy upload library bundled; network calls are file upload XHR, not exfiltration. | ai | |
| source-diff | net-exec-file:dist/upload.mjs | AI (source-diff): Same as upload.js — Uppy ESM bundle with expected upload network calls. | ai | |
| phantom-deps | phantom-dep:@wangeditor-next/list-module | AI (phantom-deps): Same-org peer dependency declared for consumers; not directly imported in this bundle. | ai | |
| phantom-deps | phantom-dep:@wangeditor-next/video-module | AI (phantom-deps): Same-org peer dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@wangeditor-next/basic-modules | AI (phantom-deps): Same-org peer dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@wangeditor-next/code-highlight | AI (phantom-deps): Same-org peer dependency; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@wangeditor-next/upload-image-module | AI (phantom-deps): Same-org peer dependency; stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/core.js | AI (source-diff): Standard minified UMD bundle for a rich-text editor; not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/core.mjs | AI (source-diff): Standard minified ESM bundle; expected build artifact. | ai | |
| phantom-deps | phantom-dep:lodash.foreach | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:lodash.isequal | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:lodash.toarray | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:lodash.debounce | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:lodash.throttle | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:@uppy/xhr-upload | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:lodash.camelcase | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:lodash.clonedeep | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai | |
| phantom-deps | phantom-dep:nanoid | AI (phantom-deps): Used by bundled sub-packages; stable false positive for this editor package. | ai | |
| phantom-deps | phantom-dep:is-hotkey | AI (phantom-deps): Used by bundled sub-packages; stable false positive. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 5.7.10 | 20 / 3 | |
| 5.7.9 | 20 / 3 | |
| 5.7.8 | 20 / 3 | |
| 5.7.7 | 20 / 3 | |
| 5.7.6 | 20 / 3 | |
| 5.7.5 | 20 / 3 | |
| 5.7.4 | 20 / 3 | |
| 5.7.3 | 20 / 3 | |
| 5.7.2 | 20 / 3 | |
| 5.7.1 | 20 / 3 | |
| 5.7.0 | 20 / 3 | |
| 5.6.31 | 21 / 0 |
v5.7.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cycleccc.
v5.7.3
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cycleccc.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.2
10 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cycleccc.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.1
10 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: cycleccc.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.6.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.