@wix/public-editor-platform-errors
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Wix internal package published via wix-ci-publisher; sparse metadata is a known pattern for Wix's internal npm packages. | ai |
v1.9.0
2 findingsMatched 4 signal(s), weighted score 7: • [S_PUBLISHER_MASS_PRODUCTION] Maintainer 'oferb-wix' owns 63 packages, ≥70% share a templated name shape. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.0
2 findingsMatched 4 signal(s), weighted score 7: • [S_PUBLISHER_MASS_PRODUCTION] Maintainer 'oferb-wix' owns 63 packages, ≥70% share a templated name shape. • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared.
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.