hast-util-raw
hast utility to reparse a tree
29
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
wooormkmck
Keywords
hast-utilhasthtmlunistutilityutilparseraw
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-removed | AI (maintainer-change): wooorm (Titus Wormer) is the primary maintainer of the unified/syntax-tree ecosystem; removal of co-maintainers is routine housekeeping, not a takeover signal. | ai | |
| phantom-deps | phantom-dep:@types/parse5 | AI (phantom-deps): @types/* packages are TypeScript type definitions; declaring them as deps is a common pattern in TS-first packages with no security implication. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): kmck and murderlon are known contributors in the unified/syntax-tree ecosystem; addition reflects legitimate collaborative maintenance, not a hostile takeover. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase from 7KB to 22KB reflects expanded functionality in a major version bump; no obfuscation or injected payload indicators present. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (extend, unist-util-visit, mdast-util-to-hast) are established unified-ecosystem packages added as part of a legitimate major version bump by a trusted maintainer. | ai | |
| dependencies | unvetted-dep:html-void-elements | AI (dependencies): html-void-elements is a standard utility in the unified ecosystem; legitimate dependency. | ai | |
| dependencies | unvetted-dep:hast-util-to-parse5 | AI (dependencies): hast-util-to-parse5 is a core syntax-tree package; legitimate dependency. | ai | |
| dependencies | unvetted-dep:unist-util-position | AI (dependencies): unist-util-position is a core unified ecosystem package; legitimate dependency. | ai | |
| dependencies | unvetted-dep:hast-util-from-parse5 | AI (dependencies): hast-util-from-parse5 is a core syntax-tree package; legitimate dependency. | ai | |
| dependencies | unvetted-dep:@ungap/structured-clone | AI (dependencies): @ungap/structured-clone is a well-known polyfill package; legitimate dependency for cross-environment compatibility. | ai | |
| dependencies | unvetted-dep:mdast-util-to-hast | AI (dependencies): mdast-util-to-hast is a core unified/syntax-tree package; legitimate dependency. | ai | |
| dependencies | unvetted-dep:vfile | AI (dependencies): vfile is a core unified ecosystem package maintained by the same community; legitimate dependency for this package. | ai | |
| dependencies | unvetted-dep:zwitch | AI (dependencies): zwitch is a well-known utility in the unified ecosystem; legitimate dependency. | ai | |
| dependencies | unvetted-dep:web-namespaces | AI (dependencies): web-namespaces is a standard utility in the unified/syntax-tree ecosystem; legitimate dependency. | ai | |
| dependencies | unvetted-dep:unist-util-visit | AI (dependencies): unist-util-visit is a core unified ecosystem package; legitimate dependency. | ai | |
| dependencies | unvetted-dep:@types/hast | AI (dependencies): TypeScript type definitions are standard dependencies for typed libraries; @types/hast is a legitimate peer type definition. | ai | |
| provenance | no-provenance | AI (provenance): Package predates widespread Sigstore provenance adoption on npm; wooorm is a highly trusted publisher with a long track record and zero rejections. | ai | |
| phantom-deps | phantom-dep:@types/unist | AI (phantom-deps): @types/unist is a TypeScript type package; declaring it as a dependency without direct import is a standard pattern for providing types to consumers. | ai | |
| phantom-deps | phantom-dep:@types/hast | AI (phantom-deps): Type definitions are framework-scoped and loaded by convention; not a functional phantom dependency. | ai |
Versions (showing 29 of 29)
| Version | Deps | Published |
|---|---|---|
| 9.1.0 | 13 / 14 | |
| 9.0.4 | 13 / 14 | |
| 9.0.3 | 13 / 14 | |
| 9.0.2 | 13 / 13 | |
| 9.0.1 | 13 / 13 | |
| 9.0.0 | 12 / 13 | |
| 8.0.0 | 12 / 12 | |
| 7.2.3 | 11 / 16 | |
| 7.2.2 | 11 / 16 | |
| 7.2.1 | 11 / 16 | |
| 7.2.0 | 11 / 16 | |
| 7.1.1 | 12 / 16 | |
| 7.1.0 | 12 / 16 | |
| 7.0.0 | 12 / 16 | |
| 6.1.0 | 11 / 15 | |
| 6.0.2 | 10 / 15 | |
| 6.0.1 | 10 / 15 | |
| 6.0.0 | 10 / 15 | |
| 5.0.2 | 8 / 14 | |
| 5.0.1 | 8 / 14 | |
| 5.0.0 | 8 / 14 | |
| 4.0.0 | 8 / 15 | |
| 3.0.0 | 8 / 17 | |
| 2.0.2 | 7 / 13 | |
| 2.0.1 | 7 / 13 | |
| 2.0.0 | 7 / 13 | |
| 1.2.0 | 7 / 13 | |
| 1.1.0 | 7 / 13 | |
| 1.0.0 | 7 / 13 |