remark-slug
Deprecated: this package is no longer maintained. Please use `remark-rehype` to move from remark (markdown) to rehype (HTML) and then replace `remark-slug` with [`rehype-slug`](https://github.com/rehypejs/rehype-slug).
19
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
remcohaszingjohnowooorm
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:mdast-util-to-string | AI (dependencies): mdast-util-to-string is a core unified ecosystem utility maintained by wooorm, the same author as remark-slug. No security risk. | ai | |
| dependencies | unvetted-dep:@types/hast | AI (dependencies): @types/hast is a canonical TypeScript type definition package for the unified/hast ecosystem, maintained by wooorm. No security risk. | ai | |
| dependencies | unvetted-dep:@types/mdast | AI (dependencies): @types/mdast is a canonical TypeScript type definition package for the unified/mdast ecosystem, maintained by wooorm. No security risk. | ai | |
| phantom-deps | phantom-dep:@types/mdast | AI (phantom-deps): @types/mdast is a TypeScript type-only package; same rationale as @types/hast — declared for TS consumers, not directly imported in JS. | ai | |
| phantom-deps | phantom-dep:@types/hast | AI (phantom-deps): @types/hast is a TypeScript type-only package; declaring it as a dep without direct JS import is standard practice for TypeScript-first packages in the unified ecosystem. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): remcohaszing is a known remark/unified ecosystem contributor; addition is a legitimate handoff alongside trusted publisher wooorm. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Signals (no deps, tiny payload, minimal README) are consistent with a deliberate deprecation stub release, not spam or malware. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy followed by a stub/deprecation release is expected for a superseded package in the remark ecosystem; not indicative of takeover. | ai |