docsify

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:postinstall	AI (install-scripts): opencollective-postinstall is a well-known donation-prompt script; stable and benign for this package.	ai	2026/05/22
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() in a documentation/template engine is expected; used for rendering user-authored content.	ai	2026/05/22
phantom-deps	phantom-dep:marked	AI (phantom-deps): Dependencies are bundled into lib/docsify.js; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:prismjs	AI (phantom-deps): Bundled dependency; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:tinydate	AI (phantom-deps): Bundled dependency; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:tweezer.js	AI (phantom-deps): Bundled dependency; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:medium-zoom	AI (phantom-deps): Bundled dependency; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:strip-indent	AI (phantom-deps): Bundled dependency; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22
phantom-deps	phantom-dep:opencollective-postinstall	AI (phantom-deps): Used in postinstall script; phantom-dep heuristic is a stable false positive for this package.	ai	2026/05/22

Version	Deps	Published
4.13.1	7 / 41	2023-06-24