← Home

emdash

npm Repository Homepage
24
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

irvinebroqueascorbic

Keywords

astrocmscontentwordpress

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/index-BV8iJ-6s.d.mts AI (source-diff): TypeScript declaration file with long import/type lines; not executable obfuscated code. ai
source-diff obfuscated-file:dist/bylines-BdUP8NuI.d.mts AI (source-diff): TypeScript declaration file with long lines from complex Zod generic types; not executable obfuscated code. ai
source-diff obfuscated-file:dist/redirects-COMLwsV5.mjs AI (source-diff): Bundled ESM output with long lines from Zod schemas; not obfuscated. Stable pattern for this build-tool-generated package. ai
source-diff obfuscated-file:dist/index-Dlkzhb4C.d.mts AI (source-diff): File is a bundled TypeScript declaration (.d.mts); long lines are type exports, not obfuscated code. ai
source-diff obfuscated-file:dist/index-Cg-rC4Gj.d.mts AI (source-diff): File is a generated TypeScript declaration (.d.mts) with long import lines; not obfuscation. Expected artifact for this build. ai
source-diff obfuscated-file:dist/index-BogfvE-z.d.mts AI (source-diff): File is a bundled TypeScript declaration rollup (.d.mts); long lines are type imports, not obfuscation. ai
source-diff obfuscated-file:dist/index-BFRaVcD6.d.mts AI (source-diff): TypeScript declaration file with long import lines; not executable code, not obfuscation. ai
source-diff obfuscated-file:dist/index-De6_Xv3v.d.mts AI (source-diff): TypeScript declaration file generated by tsdown; long lines are bundled type unions, not obfuscation. ai
source-diff obfuscated-file:dist/index-CCWzlriB.d.mts AI (source-diff): Bundled .d.mts type declaration file with long lines from concatenated type defs; not obfuscated code. ai
source-diff obfuscated-file:dist/index-DIb-CzNx.d.mts AI (source-diff): TypeScript declaration file with long lines from bundled type imports; not obfuscation. ai
source-diff obfuscated-file:dist/index-BYv0mB9g.d.mts AI (source-diff): Long lines are bundled TypeScript type declarations (.d.mts), not obfuscated code. Stable false positive for this package. ai
source-diff obfuscated-file:dist/index-CRg3PWfZ.d.mts AI (source-diff): Standard bundler-generated TypeScript declaration file with long import lines; not obfuscated code. ai
source-diff obfuscated-file:dist/index-DjPMOfO0.d.mts AI (source-diff): Bundled TypeScript declaration file with long import lines; not obfuscation. Pattern will recur on every build. ai
phantom-deps phantom-dep:@unpic/placeholder AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:jose AI (phantom-deps): jose is a declared runtime dep; phantom-dep heuristic false positive for this package. ai
semgrep semgrep:env-spread AI (semgrep): Spreading process.env into child process spawn options is standard CLI dev-server pattern, not exfiltration. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Reflect.get/set used to copy Astro internal symbol between Response objects — documented Astro integration pattern. ai
typosquat typosquat.levenshtein:lodash AI (typosquat): emdash is a legitimate Astro CMS; name similarity to lodash is coincidental, not impersonation. ai

Versions (showing 24 of 24)

Version Deps Published
1.0.0 37 / 15
0.17.1 45 / 15
0.17.0 45 / 15
0.16.0 45 / 15
0.15.0 45 / 15
0.14.0 43 / 15
0.13.0 43 / 15
0.12.0 40 / 15
0.11.1 40 / 15
0.11.0 40 / 15
0.10.0 39 / 15
0.9.0 39 / 15
0.8.0 37 / 15
0.7.0 37 / 14
0.6.0 37 / 14
0.5.0 37 / 14
0.4.0 37 / 14
0.3.0 37 / 14
0.2.0 37 / 14
0.1.1 37 / 14
0.1.0 37 / 14
0.0.3 37 / 14
0.0.2 37 / 14
0.0.1 37 / 14

v1.0.0

2 findings
HIGH New obfuscated file: dist/index-DIb-CzNx.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.17.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.17.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.0

2 findings
HIGH New obfuscated file: dist/redirects-COMLwsV5.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.0

3 findings
HIGH New obfuscated file: dist/bylines-BdUP8NuI.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index-BV8iJ-6s.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.0

2 findings
HIGH New obfuscated file: dist/index-Dlkzhb4C.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.1

2 findings
HIGH New obfuscated file: dist/index-BogfvE-z.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.10.0

2 findings
HIGH New obfuscated file: dist/index-DjPMOfO0.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.9.0

2 findings
HIGH New obfuscated file: dist/index-BFRaVcD6.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.7.0

2 findings
HIGH New obfuscated file: dist/index-De6_Xv3v.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.6.0

2 findings
HIGH New obfuscated file: dist/index-BYv0mB9g.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.5.0

2 findings
HIGH New obfuscated file: dist/index-CCWzlriB.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

2 findings
HIGH New obfuscated file: dist/index-CRg3PWfZ.d.mts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.