remarkable
Markdown parser, done right. 100% Commonmark support, extensions, syntax plugins, high speed - all in one.
6
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
doowbjoeybakerjonschlinkertmatthewmuellernikolaspkfladsetsophiebitstrysound
Keywords
commonmarkmarkdownmdparseparserprocessremarkablerenderrenderertext
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Legitimate maintainer transition to trysound, a well-established publisher (1507 approved versions, 11yr history). Original maintainers retained in package.json. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): spicyj removed likely reflects sophiebits username change (same person: Sophie Alpert). | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Added maintainers (matthewmueller, sophiebits, trysound) are known community members; legitimate transition. | ai | |
| provenance | missing-githead | AI (provenance): Expected when publish environment changes during maintainer transition; no malicious indicators. | ai | |
| provenance | no-provenance | AI (provenance): remarkable predates Sigstore provenance; absence is expected and stable for this package. | ai | |
| source-diff | net-exec-file:dist/cjs/index.browser.js | AI (source-diff): Bundled markdown parser code; innerHTML for entity decoding is not a network call. False positive on remarkable's standard dist output. | ai | |
| source-diff | net-exec-file:dist/esm/index.js | AI (source-diff): ESM bundle of remarkable with entity table; no actual network or malicious exec. Standard dist output. | ai | |
| source-diff | net-exec-file:dist/esm/index.browser.js | AI (source-diff): ESM browser bundle of remarkable; innerHTML entity decoding misclassified as network call. Standard dist output. | ai | |
| source-diff | net-exec-file:dist/cjs/index.js | AI (source-diff): Bundled markdown parser with HTML entity table; no actual network or malicious exec patterns. Standard dist output. | ai |