fumadocs-core @16.8.0
rejected
This version was rejected.
It did not pass GreenFlagged's security review and is not served by the registry.
The findings and risk dispositions below explain why.
70
Risk Score
—
License
No
Install Scripts
17
Dependencies
32
Dev Dependencies
124.6 KB
Package Size
Published
Maintainers
sonmoosans
Keywords
DocsFumadocs
Dependencies (17)
| Package | Constraint | Registry Status |
|---|---|---|
| shiki | ^4.0.2 | auto_approved |
| vfile | ^6.0.3 | auto_approved |
| remark | ^15.0.1 | auto_approved |
| js-yaml | ^4.1.1 | auto_approved |
| unified | ^11.0.5 | auto_approved |
| remark-gfm | ^4.0.1 | auto_approved |
| tinyglobby | ^0.2.16 | auto_approved |
| @orama/orama | ^3.1.18 | auto_approved |
| remark-rehype | ^11.1.2 | auto_approved |
| github-slugger | ^2.0.0 | auto_approved |
| mdast-util-mdx | ^3.0.0 | auto_approved |
| unist-util-visit | ^5.1.0 | auto_approved |
| hast-util-to-estree | ^3.1.3 | auto_approved |
| mdast-util-to-markdown | ^2.1.2 | auto_approved |
| hast-util-to-jsx-runtime | ^2.3.6 | auto_approved |
| scroll-into-view-if-needed | ^3.1.0 | auto_approved |
| estree-util-value-to-estree | ^3.5.0 | auto_approved |
Dev Dependencies (32)
| Package | Constraint | Registry Status |
|---|---|---|
| zod | ^4.3.6 | auto_approved |
| next | 16.2.3 | auto_approved |
| waku | 1.0.0-alpha.7 | auto_approved |
| tsdown | 0.21.8 | auto_approved |
| tsconfig | 0.0.0 | pending |
| flexsearch | ^0.8.212 | needs_review |
| image-size | ^2.0.2 | auto_approved |
| negotiator | ^1.0.0 | auto_approved |
| remark-mdx | ^3.1.1 | auto_approved |
| typescript | ^6.0.2 | auto_approved |
| @mdx-js/mdx | ^3.1.1 | auto_approved |
| @orama/core | ^1.2.19 | Not imported |
| @types/hast | ^3.0.4 | auto_approved |
| @types/node | 25.6.0 | auto_approved |
| npm-to-yarn | ^3.0.1 | pending |
| @types/mdast | ^4.0.4 | auto_approved |
| @types/react | ^19.2.14 | auto_approved |
| lucide-react | ^1.8.0 | auto_approved |
| react-router | ^7.14.1 | auto_approved |
| algoliasearch | 5.50.2 | auto_approved |
| @types/js-yaml | ^4.0.9 | auto_approved |
| path-to-regexp | ^8.4.2 | auto_approved |
| @mixedbread/sdk | ^0.61.0 | auto_approved |
| remove-markdown | ^0.6.3 | auto_approved |
| @types/react-dom | ^19.2.3 | auto_approved |
| remark-directive | ^4.0.0 | auto_approved |
| @types/estree-jsx | ^1.0.5 | auto_approved |
| @types/negotiator | ^0.6.4 | pending |
| @oramacloud/client | ^2.1.4 | Not imported |
| @shikijs/transformers | ^4.0.2 | auto_approved |
| @tanstack/react-router | 1.168.22 | auto_approved |
| @formatjs/intl-localematcher | ^0.8.3 | auto_approved |
Transitive Dependency Tree
125 transitive deps
max depth 10
├─
@orama/orama
^3.1.18
→ 3.1.18
├─
estree-util-value-to-estree
^3.5.0
→ 3.5.0
├─
github-slugger
^2.0.0
→ 2.0.0
├─
hast-util-to-estree
^3.1.3
→ 3.1.3
├─
hast-util-to-jsx-runtime
^2.3.6
→ 2.3.6
├─
js-yaml
^4.1.1
→ 4.1.1
├─
mdast-util-mdx
^3.0.0
→ 3.0.0
├─
mdast-util-to-markdown
^2.1.2
→ 2.1.2
├─
remark
^15.0.1
→ 15.0.1
├─
remark-gfm
^4.0.1
→ 4.0.1
├─
remark-rehype
^11.1.2
→ 11.1.2
├─
scroll-into-view-if-needed
^3.1.0
→ 3.1.0
├─
shiki
^4.0.2
→ 4.0.2
├─
tinyglobby
^0.2.16
→ 0.2.16
├─
unified
^11.0.5
→ 11.0.5
├─
unist-util-visit
^5.1.0
→ 5.1.0
├─
vfile
^6.0.3
→ 6.0.3
├─
@shikijs/core
4.0.2
→ 4.0.2
├─
@shikijs/engine-javascript
4.0.2
→ 4.0.2
├─
@shikijs/engine-oniguruma
4.0.2
→ 4.0.2
├─
@shikijs/langs
4.0.2
→ 4.0.2
├─
@shikijs/themes
4.0.2
→ 4.0.2
├─
@shikijs/types
4.0.2
→ 4.0.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/estree
^1.0.0
→ 1.0.8
├─
@types/estree-jsx
^1.0.0
→ 1.0.5
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/mdast
^4.0.0
├─
@types/unist
^3.0.0
→ 3.0.3
├─
argparse
^2.0.1
→ 2.0.1
├─
bail
^2.0.0
→ 2.0.2
├─
comma-separated-tokens
^2.0.0
→ 2.0.3
├─
comma-separated-tokens
^2.0.0
├─
compute-scroll-into-view
^3.0.2
├─
devlop
^1.0.0
→ 1.1.0
├─
estree-util-attach-comments
^3.0.0
├─
estree-util-is-identifier-name
^3.0.0
→ 3.0.0
├─
extend
^3.0.0
→ 3.0.2
├─
fdir
^6.5.0
→ 6.5.0
├─
hast-util-whitespace
^3.0.0
→ 3.0.0
├─
is-plain-obj
^4.0.0
→ 4.1.0
├─
longest-streak
^3.0.0
├─
mdast-util-from-markdown
^2.0.0
→ 2.0.3
├─
mdast-util-gfm
^3.0.0
→ 3.1.0
├─
mdast-util-mdx-expression
^2.0.0
→ 2.0.1
├─
mdast-util-mdx-jsx
^3.0.0
→ 3.2.0
├─
mdast-util-mdxjs-esm
^2.0.0
→ 2.0.1
├─
mdast-util-phrasing
^4.0.0
→ 4.1.0
├─
mdast-util-to-hast
^13.0.0
├─
mdast-util-to-markdown
^2.0.0
→ 2.1.2
├─
mdast-util-to-string
^4.0.0
├─
micromark-extension-gfm
^3.0.0
→ 3.0.0
├─
micromark-util-classify-character
^2.0.0
├─
micromark-util-decode-string
^2.0.0
→ 2.0.1
├─
picomatch
^4.0.4
→ 4.0.4
├─
property-information
^7.0.0
→ 7.1.0
├─
remark-parse
^11.0.0
├─
remark-stringify
^11.0.0
→ 11.0.0
├─
space-separated-tokens
^2.0.0
├─
space-separated-tokens
^2.0.0
→ 2.0.2
├─
style-to-js
^1.0.0
→ 1.1.21
├─
trough
^2.0.0
→ 2.2.0
├─
unified
^11.0.0
→ 11.0.5
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-position
^5.0.0
→ 5.0.0
├─
unist-util-position
^5.0.0
├─
unist-util-visit
^5.0.0
→ 5.0.0
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
vfile
^6.0.0
→ 6.0.3
├─
vfile-message
^4.0.0
→ 4.0.3
├─
zwitch
^2.0.0
├─
@shikijs/primitive
4.0.2
→ 4.0.2
├─
@shikijs/types
4.0.2
→ 4.0.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/estree
*
→ 1.0.8
├─
@types/estree-jsx
^1.0.0
→ 1.0.5
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/mdast
^4.0.0
├─
@types/unist
^3.0.0
→ 3.0.3
├─
@types/unist
*
├─
bail
^2.0.0
→ 2.0.2
├─
ccount
^2.0.0
├─
decode-named-character-reference
^1.0.0
→ 1.3.0
├─
dequal
^2.0.0
→ 2.0.3
├─
devlop
^1.0.0
→ 1.1.0
├─
devlop
^1.1.0
→ 1.1.0
├─
extend
^3.0.0
→ 3.0.2
├─
hast-util-to-html
^9.0.5
→ 9.0.5
├─
is-plain-obj
^4.0.0
→ 4.1.0
├─
longest-streak
^3.0.0
├─
mdast-util-from-markdown
^2.0.0
→ 2.0.3
├─
mdast-util-gfm-autolink-literal
^2.0.0
→ 2.0.1
├─
mdast-util-gfm-footnote
^2.0.0
→ 2.1.0
├─
mdast-util-gfm-strikethrough
^2.0.0
→ 2.0.0
├─
mdast-util-gfm-table
^2.0.0
→ 2.0.0
├─
mdast-util-gfm-task-list-item
^2.0.0
→ 2.0.0
├─
mdast-util-phrasing
^4.0.0
→ 4.1.0
├─
mdast-util-to-markdown
^2.0.0
→ 2.1.2
├─
mdast-util-to-string
^4.0.0
├─
micromark
^4.0.0
→ 4.0.2
├─
micromark-extension-gfm-autolink-literal
^2.0.0
→ 2.1.0
├─
micromark-extension-gfm-footnote
^2.0.0
→ 2.1.0
├─
micromark-extension-gfm-strikethrough
^2.0.0
→ 2.1.0
├─
micromark-extension-gfm-table
^2.0.0
→ 2.1.1
├─
micromark-extension-gfm-tagfilter
^2.0.0
├─
micromark-extension-gfm-task-list-item
^2.0.0
→ 2.1.0
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-classify-character
^2.0.0
├─
micromark-util-combine-extensions
^2.0.0
→ 2.0.1
├─
micromark-util-decode-numeric-character-reference
^2.0.0
├─
micromark-util-decode-numeric-character-reference
^2.0.0
→ 2.0.2
├─
micromark-util-decode-string
^2.0.0
→ 2.0.1
├─
micromark-util-normalize-identifier
^2.0.0
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-types
^2.0.0
├─
oniguruma-to-es
^4.3.4
→ 4.3.6
├─
parse-entities
^4.0.0
→ 4.0.2
├─
stringify-entities
^4.0.0
→ 4.0.4
├─
style-to-object
1.0.14
→ 1.0.14
├─
trough
^2.0.0
→ 2.2.0
├─
unified
^11.0.0
→ 11.0.5
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-stringify-position
^4.0.0
├─
unist-util-visit
^5.0.0
→ 5.0.0
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
vfile
^6.0.0
→ 6.0.3
├─
vfile-message
^4.0.0
→ 4.0.3
├─
zwitch
^2.0.0
├─
@shikijs/types
4.0.2
→ 4.0.2
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/debug
^4.0.0
→ 4.1.13
├─
@types/estree
*
→ 1.0.8
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/mdast
^4.0.0
├─
@types/unist
*
├─
@types/unist
^3.0.0
→ 3.0.3
├─
@types/unist
^2.0.0
├─
bail
^2.0.0
→ 2.0.2
├─
ccount
^2.0.0
├─
ccount
^2.0.0
→ 2.0.1
├─
character-entities
^2.0.0
├─
character-entities-html4
^2.0.0
├─
character-entities-legacy
^3.0.0
├─
character-reference-invalid
^2.0.0
├─
comma-separated-tokens
^2.0.0
→ 2.0.3
├─
debug
^4.0.0
→ 4.4.3
├─
decode-named-character-reference
^1.0.0
→ 1.3.0
├─
dequal
^2.0.0
→ 2.0.3
├─
devlop
^1.0.0
→ 1.1.0
├─
devlop
^1.1.0
→ 1.1.0
├─
extend
^3.0.0
→ 3.0.2
├─
hast-util-whitespace
^3.0.0
→ 3.0.0
├─
html-void-elements
^3.0.0
→ 3.0.0
├─
inline-style-parser
0.2.7
→ 0.2.7
├─
is-alphanumerical
^2.0.0
→ 2.0.1
├─
is-decimal
^2.0.0
├─
is-hexadecimal
^2.0.0
├─
is-plain-obj
^4.0.0
→ 4.1.0
├─
longest-streak
^3.0.0
├─
markdown-table
^3.0.0
→ 3.0.4
├─
mdast-util-find-and-replace
^3.0.0
→ 3.0.2
├─
mdast-util-from-markdown
^2.0.0
→ 2.0.3
├─
mdast-util-phrasing
^4.0.0
→ 4.1.0
├─
mdast-util-to-hast
^13.0.0
├─
mdast-util-to-markdown
^2.0.0
→ 2.1.2
├─
mdast-util-to-string
^4.0.0
├─
micromark
^4.0.0
→ 4.0.2
├─
micromark-core-commonmark
^2.0.0
→ 2.0.3
├─
micromark-factory-space
^2.0.0
→ 2.0.1
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-chunked
^2.0.0
├─
micromark-util-classify-character
^2.0.0
├─
micromark-util-combine-extensions
^2.0.0
→ 2.0.1
├─
micromark-util-decode-numeric-character-reference
^2.0.0
→ 2.0.2
├─
micromark-util-decode-numeric-character-reference
^2.0.0
├─
micromark-util-decode-string
^2.0.0
→ 2.0.1
├─
micromark-util-encode
^2.0.0
├─
micromark-util-normalize-identifier
^2.0.0
├─
micromark-util-resolve-all
^2.0.0
├─
micromark-util-sanitize-uri
^2.0.0
→ 2.0.1
├─
micromark-util-subtokenize
^2.0.0
→ 2.1.0
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-types
^2.0.0
├─
micromark-util-types
^2.0.0
→ 2.0.2
├─
oniguruma-parser
^0.12.2
├─
property-information
^7.0.0
→ 7.1.0
├─
regex
^6.1.0
→ 6.1.0
├─
regex-recursion
^6.0.2
→ 6.0.2
├─
space-separated-tokens
^2.0.0
→ 2.0.2
├─
stringify-entities
^4.0.0
→ 4.0.4
├─
trough
^2.0.0
→ 2.2.0
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-stringify-position
^4.0.0
├─
unist-util-visit
^5.0.0
→ 5.0.0
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
vfile
^6.0.0
→ 6.0.3
├─
vfile-message
^4.0.0
→ 4.0.3
├─
zwitch
^2.0.4
→ 2.0.4
├─
zwitch
^2.0.0
├─
@shikijs/vscode-textmate
^10.0.2
→ 10.0.2
├─
@types/debug
^4.0.0
→ 4.1.13
├─
@types/hast
^3.0.0
→ 3.0.4
├─
@types/hast
^3.0.4
→ 3.0.4
├─
@types/mdast
^4.0.0
├─
@types/ms
*
├─
@types/unist
*
├─
@types/unist
^3.0.0
→ 3.0.3
├─
character-entities
^2.0.0
├─
character-entities-html4
^2.0.0
├─
character-entities-legacy
^3.0.0
├─
debug
^4.0.0
→ 4.4.3
├─
decode-named-character-reference
^1.0.0
→ 1.3.0
├─
dequal
^2.0.0
→ 2.0.3
├─
devlop
^1.0.0
→ 1.1.0
├─
escape-string-regexp
^5.0.0
→ 5.0.0
├─
is-alphabetical
^2.0.0
→ 2.0.1
├─
is-decimal
^2.0.0
├─
longest-streak
^3.0.0
├─
mdast-util-phrasing
^4.0.0
→ 4.1.0
├─
mdast-util-to-string
^4.0.0
├─
micromark
^4.0.0
→ 4.0.2
├─
micromark-core-commonmark
^2.0.0
→ 2.0.3
├─
micromark-factory-destination
^2.0.0
├─
micromark-factory-label
^2.0.0
→ 2.0.1
├─
micromark-factory-space
^2.0.0
→ 2.0.1
├─
micromark-factory-title
^2.0.0
├─
micromark-factory-whitespace
^2.0.0
→ 2.0.1
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-chunked
^2.0.0
├─
micromark-util-chunked
^2.0.0
→ 2.0.1
├─
micromark-util-classify-character
^2.0.0
→ 2.0.1
├─
micromark-util-classify-character
^2.0.0
├─
micromark-util-combine-extensions
^2.0.0
→ 2.0.1
├─
micromark-util-decode-numeric-character-reference
^2.0.0
→ 2.0.2
├─
micromark-util-decode-numeric-character-reference
^2.0.0
├─
micromark-util-decode-string
^2.0.0
→ 2.0.1
├─
micromark-util-encode
^2.0.0
├─
micromark-util-html-tag-name
^2.0.0
├─
micromark-util-normalize-identifier
^2.0.0
→ 2.0.1
├─
micromark-util-normalize-identifier
^2.0.0
├─
micromark-util-resolve-all
^2.0.0
├─
micromark-util-sanitize-uri
^2.0.0
→ 2.0.1
├─
micromark-util-subtokenize
^2.0.0
→ 2.1.0
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-types
^2.0.0
→ 2.0.2
├─
micromark-util-types
^2.0.0
├─
ms
^2.1.3
→ 2.1.3
├─
regex-utilities
^2.3.0
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-is
^6.0.0
├─
unist-util-stringify-position
^4.0.0
├─
unist-util-visit
^5.0.0
→ 5.0.0
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
vfile-message
^4.0.0
→ 4.0.3
├─
zwitch
^2.0.0
├─
@types/debug
^4.0.0
→ 4.1.13
├─
@types/mdast
^4.0.0
├─
@types/ms
*
├─
@types/unist
*
├─
@types/unist
^3.0.0
→ 3.0.3
├─
character-entities
^2.0.0
├─
debug
^4.0.0
→ 4.4.3
├─
decode-named-character-reference
^1.0.0
→ 1.3.0
├─
dequal
^2.0.0
→ 2.0.3
├─
devlop
^1.0.0
→ 1.1.0
├─
micromark-core-commonmark
^2.0.0
→ 2.0.3
├─
micromark-factory-destination
^2.0.0
├─
micromark-factory-label
^2.0.0
→ 2.0.1
├─
micromark-factory-space
^2.0.0
→ 2.0.1
├─
micromark-factory-title
^2.0.0
├─
micromark-factory-whitespace
^2.0.0
→ 2.0.1
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-chunked
^2.0.0
├─
micromark-util-chunked
^2.0.0
→ 2.0.1
├─
micromark-util-classify-character
^2.0.0
→ 2.0.1
├─
micromark-util-combine-extensions
^2.0.0
→ 2.0.1
├─
micromark-util-decode-numeric-character-reference
^2.0.0
→ 2.0.2
├─
micromark-util-encode
^2.0.0
├─
micromark-util-html-tag-name
^2.0.0
├─
micromark-util-normalize-identifier
^2.0.0
→ 2.0.1
├─
micromark-util-normalize-identifier
^2.0.0
├─
micromark-util-resolve-all
^2.0.0
├─
micromark-util-sanitize-uri
^2.0.0
→ 2.0.1
├─
micromark-util-subtokenize
^2.0.0
→ 2.1.0
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-types
^2.0.0
├─
micromark-util-types
^2.0.0
→ 2.0.2
├─
ms
^2.1.3
→ 2.1.3
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
unist-util-stringify-position
^4.0.0
├─
unist-util-visit-parents
^6.0.0
→ 6.0.2
├─
@types/ms
*
├─
@types/unist
^3.0.0
→ 3.0.3
├─
character-entities
^2.0.0
├─
decode-named-character-reference
^1.0.0
→ 1.3.0
├─
dequal
^2.0.0
→ 2.0.3
├─
devlop
^1.0.0
→ 1.1.0
├─
micromark-factory-destination
^2.0.0
├─
micromark-factory-label
^2.0.0
→ 2.0.1
├─
micromark-factory-space
^2.0.0
→ 2.0.1
├─
micromark-factory-title
^2.0.0
├─
micromark-factory-whitespace
^2.0.0
→ 2.0.1
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-chunked
^2.0.0
→ 2.0.1
├─
micromark-util-chunked
^2.0.0
├─
micromark-util-classify-character
^2.0.0
→ 2.0.1
├─
micromark-util-encode
^2.0.0
├─
micromark-util-html-tag-name
^2.0.0
├─
micromark-util-normalize-identifier
^2.0.0
→ 2.0.1
├─
micromark-util-resolve-all
^2.0.0
├─
micromark-util-subtokenize
^2.0.0
→ 2.1.0
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-types
^2.0.0
├─
micromark-util-types
^2.0.0
→ 2.0.2
├─
ms
^2.1.3
→ 2.1.3
├─
unist-util-is
^6.0.0
→ 6.0.1
├─
@types/unist
^3.0.0
→ 3.0.3
├─
character-entities
^2.0.0
├─
dequal
^2.0.0
→ 2.0.3
├─
devlop
^1.0.0
→ 1.1.0
├─
micromark-factory-space
^2.0.0
→ 2.0.1
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-chunked
^2.0.0
→ 2.0.1
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-types
^2.0.0
├─
micromark-util-types
^2.0.0
→ 2.0.2
├─
dequal
^2.0.0
→ 2.0.3
├─
micromark-util-character
^2.0.0
→ 2.1.1
├─
micromark-util-symbol
^2.0.0
→ 2.0.1
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-types
^2.0.0
├─
micromark-util-symbol
^2.0.0
├─
micromark-util-types
^2.0.0
Changes from v16.7.16
Dependency Changes
| Change | Package | Version |
|---|---|---|
| added | js-yaml | ^4.1.1 |
| removed | @shikijs/transformers | ^4.0.2 |
File Changes
50 added
43 removed
69 modified
size delta: +19.9 KB
Risk Dispositions (2 applicable to this version, 0 other)
Accepted rules are downgraded to INFO on future analyses; rejected rules escalate to CRITICAL.
| Rule | Source | Disposition | Author | Reason | |
|---|---|---|---|---|---|
regressed-provenance |
provenance | reject | AI | AI (provenance): Provenance regression combined with publisher change is a strong compromise signal for this package. | |
publisher-changed |
provenance | reject | AI | AI (provenance): Publisher changed from GitHub Actions to a human account first seen 24 days ago with no prior publish history. |
SAST Findings (3)
HIGH
Provenance attestation missing — previous versions had it
provenance
This version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
HIGH
Publisher changed: GitHub Actions → sonmoosans (on 2026-04-19)
provenance
This version was published by a different npm account than previous versions on 2026-04-19. This could indicate a legitimate maintainer transition or an account compromise.
HIGH
New obfuscated file: dist/rehype-code.core-Cz33III3.js
source-diff
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Review Summary
Risk score: 70. Findings: 2 high (+50), 2 medium (+20), 7 info (+0).
Published to npm: