emdash
30
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
irvinebroqueascorbic
Keywords
astrocmscontentwordpress
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/index-BV8iJ-6s.d.mts | AI (source-diff): TypeScript declaration file with long import/type lines; not executable obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/bylines-BdUP8NuI.d.mts | AI (source-diff): TypeScript declaration file with long lines from complex Zod generic types; not executable obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/redirects-COMLwsV5.mjs | AI (source-diff): Bundled ESM output with long lines from Zod schemas; not obfuscated. Stable pattern for this build-tool-generated package. | ai | |
| source-diff | obfuscated-file:dist/index-Dlkzhb4C.d.mts | AI (source-diff): File is a bundled TypeScript declaration (.d.mts); long lines are type exports, not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/index-Cg-rC4Gj.d.mts | AI (source-diff): File is a generated TypeScript declaration (.d.mts) with long import lines; not obfuscation. Expected artifact for this build. | ai | |
| source-diff | obfuscated-file:dist/index-BogfvE-z.d.mts | AI (source-diff): File is a bundled TypeScript declaration rollup (.d.mts); long lines are type imports, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-BFRaVcD6.d.mts | AI (source-diff): TypeScript declaration file with long import lines; not executable code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-De6_Xv3v.d.mts | AI (source-diff): TypeScript declaration file generated by tsdown; long lines are bundled type unions, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-CCWzlriB.d.mts | AI (source-diff): Bundled .d.mts type declaration file with long lines from concatenated type defs; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/index-DIb-CzNx.d.mts | AI (source-diff): TypeScript declaration file with long lines from bundled type imports; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index-BYv0mB9g.d.mts | AI (source-diff): Long lines are bundled TypeScript type declarations (.d.mts), not obfuscated code. Stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist/index-CRg3PWfZ.d.mts | AI (source-diff): Standard bundler-generated TypeScript declaration file with long import lines; not obfuscated code. | ai | |
| source-diff | obfuscated-file:dist/index-DjPMOfO0.d.mts | AI (source-diff): Bundled TypeScript declaration file with long import lines; not obfuscation. Pattern will recur on every build. | ai | |
| phantom-deps | phantom-dep:@unpic/placeholder | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:jose | AI (phantom-deps): jose is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into child process spawn options is standard CLI dev-server pattern, not exfiltration. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get/set used to copy Astro internal symbol between Response objects — documented Astro integration pattern. | ai | |
| typosquat | typosquat.levenshtein:lodash | AI (typosquat): emdash is a legitimate Astro CMS; name similarity to lodash is coincidental, not impersonation. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 1.0.0 | 37 / 15 | |
| 0.28.0 | 45 / 15 | |
| 0.23.0 | 45 / 15 | |
| 0.22.0 | 45 / 15 | |
| 0.21.0 | 45 / 15 | |
| 0.20.0 | 45 / 15 | |
| 0.18.0 | 45 / 15 | |
| 0.17.1 | 45 / 15 | |
| 0.17.0 | 45 / 15 | |
| 0.16.0 | 45 / 15 | |
| 0.15.0 | 45 / 15 | |
| 0.14.0 | 43 / 15 | |
| 0.13.0 | 43 / 15 | |
| 0.12.0 | 40 / 15 | |
| 0.11.1 | 40 / 15 | |
| 0.11.0 | 40 / 15 | |
| 0.10.0 | 39 / 15 | |
| 0.9.0 | 39 / 15 | |
| 0.8.0 | 37 / 15 | |
| 0.7.0 | 37 / 14 | |
| 0.6.0 | 37 / 14 | |
| 0.5.0 | 37 / 14 | |
| 0.4.0 | 37 / 14 | |
| 0.3.0 | 37 / 14 | |
| 0.2.0 | 37 / 14 | |
| 0.1.1 | 37 / 14 | |
| 0.1.0 | 37 / 14 | |
| 0.0.3 | 37 / 14 | |
| 0.0.2 | 37 / 14 | |
| 0.0.1 | 37 / 14 |
v0.28.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.