rc-editor-core — Greenflagged

editor-core ui component for react

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

afc163raohaiyesmeck

Keywords

reactreact-componentreact-editor-coreeditor-core

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): The install script runs 'typings install', a standard TypeScript type definition manager from the pre-@types era. Entirely benign and consistent with this package's age and purpose.	ai	2026/04/23
phantom-deps	phantom-dep:rc-editor-plugin-emoji	AI (phantom-deps): rc-editor-plugin-emoji is an editor plugin in the same ecosystem; dynamic/config-based loading rather than direct import is expected for plugin architectures.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): draft-js and immutable are well-known legitimate packages; adding them is expected for an editor-core component built on draft-js.	ai	2026/04/23
phantom-deps	phantom-dep:babel-runtime	AI (phantom-deps): babel-runtime is declared as a runtime dep and used via --babel-runtime compile flag; this is a standard Babel 6 pattern, not a true phantom dependency.	ai	2026/04/21

Versions (showing 51 of 77)

View all versions

Version	Deps	Published
0.8.9	7 / 10	2019-02-26
0.8.5	6 / 11	2018-02-24
0.8.0	6 / 10	2017-11-09
0.7.8	5 / 11	2017-06-14
0.7.7	5 / 11	2017-05-18
0.7.5	5 / 11	2017-05-15
0.7.4	5 / 11	2017-05-03
0.7.3	5 / 11	2017-05-03
0.7.2	5 / 11	2017-05-03
0.7.1	5 / 11	2017-05-03
0.7.0	5 / 11	2017-05-03
0.6.19	4 / 11	2017-02-28
0.6.18	4 / 11	2017-02-07
0.6.17	4 / 11	2017-02-07
0.6.16	4 / 11	2017-02-06
0.6.15	4 / 11	2017-02-06
0.6.14	4 / 11	2017-02-06
0.6.12	3 / 11	2017-02-06
0.6.11	4 / 11	2017-02-04
0.6.10	4 / 11	2017-02-03
0.6.9	4 / 11	2017-02-03
0.6.8	4 / 11	2017-02-03
0.6.7	4 / 11	2017-02-03
0.6.6	4 / 11	2017-02-03
0.6.5	4 / 11	2017-02-03
0.6.4	4 / 15	2017-02-03
0.6.3	4 / 13	2017-02-03
0.6.2	4 / 13	2017-02-03
0.6.1	4 / 13	2017-02-03
0.6.0	3 / 11	2017-02-03
0.5.11	4 / 11	2016-12-07
0.5.10	4 / 11	2016-11-21
0.5.9	4 / 11	2016-11-17
0.5.8	4 / 11	2016-11-11
0.5.7	4 / 11	2016-11-01
0.5.5	4 / 11	2016-09-28
0.5.4	4 / 11	2016-09-26
0.5.3	4 / 10	2016-09-20
0.5.2	3 / 10	2016-09-12
0.5.1	3 / 10	2016-09-07
0.5.0	3 / 10	2016-09-07
0.4.15	2 / 9	2016-07-29
0.4.14	2 / 9	2016-07-27
0.4.13	2 / 9	2016-07-27
0.4.12	2 / 9	2016-07-27
0.4.11	2 / 9	2016-07-22
0.4.10	2 / 9	2016-07-22
0.4.9	2 / 9	2016-07-21
0.4.8	2 / 9	2016-07-21
0.4.7	2 / 9	2016-07-21
0.4.6	2 / 9	2016-07-20

v0.8.9

2 findings

HIGH Publisher changed: raohai → zombiej (on 2019-02-26) provenance

This version was published by a different npm account than previous versions on 2019-02-26. This could indicate a legitimate maintainer transition or an account compromise.