slate-hyperscript — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

ianstormtaylorthesunnytimbuckleydylansdamareyohbrentfarese

Keywords

deserializehhtmlhyperscriptjsxserializeslatexml

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	missing-githead	AI (provenance): Manual publish by known maintainer; no code changes, benign for this package.	ai	2026/07/21
provenance	no-provenance	AI (provenance): Legacy manual publish flow; stable across versions.	ai	2026/07/21
source-diff	obfuscated-file:lib/index.js	AI (source-diff): Babel-transpiled CJS build output with readable identifiers, not obfuscation.	ai	2026/07/21
phantom-deps	phantom-dep:slate-dev-logger	AI (phantom-deps): Legit dep not surfaced in bundled/transpiled import scan.	ai	2026/07/21
source-diff	obfuscated-file-transition:lib/index.js	AI (source-diff): Babel-transpiled build output, not obfuscation; readable requires and named exports, no payload.	ai	2026/07/21
provenance	publisher-changed	AI (provenance): Legitimate CI/CD migration; SLSA attestation confirms automated publish from the same repo.	ai	2026/05/31

Versions (showing 51 of 194)

View all versions

Version	Deps	Published
0.125.0	0 / 3	2026-05-30
0.115.0	0 / 3	2025-06-02
0.100.0	1 / 3	2023-10-20
0.81.3	1 / 3	2022-07-22
0.77.0	1 / 3	2022-04-13
0.67.0	1 / 3	2021-10-18
0.66.0	1 / 3	2021-09-13
0.62.0	1 / 1	2021-04-01
0.61.3	1 / 1	2021-03-30
0.61.0	1 / 1	2021-03-29
0.60.17	1 / 1	2021-03-29
0.60.11	1 / 1	2021-03-20
0.60.9	1 / 1	2021-03-20
0.60.8	1 / 1	2021-03-11
0.60.4	1 / 1	2021-02-17
0.60.3	1 / 1	2021-02-08
0.60.2	1 / 1	2021-01-19
0.60.1	1 / 1	2020-12-11
0.60.0	1 / 1	2020-11-24
0.59.0	1 / 1	2020-09-25
0.58.4	1 / 1	2020-07-08
0.58.3	1 / 1	2020-06-04
0.58.1	1 / 1	2020-05-11
0.58.0	1 / 1	2020-05-06
0.57.3	1 / 1	2020-05-05
0.57.2	1 / 1	2020-04-24
0.57.1	1 / 1	2019-12-20
0.57.0	1 / 1	2019-12-18
0.56.1	1 / 1	2019-12-18
0.56.0	1 / 1	2019-12-18
0.55.3	1 / 1	2019-12-16
0.55.2	1 / 1	2019-12-16
0.55.1	1 / 1	2019-12-16
0.55.0	1 / 1	2019-12-16
0.54.6	1 / 1	2019-12-14
0.54.5	1 / 1	2019-12-13
0.54.4	1 / 1	2019-12-13
0.54.3	1 / 1	2019-12-13
0.54.2	1 / 1	2019-12-13
0.54.1	1 / 1	2019-12-12
0.54.0	1 / 1	2019-12-12
0.53.0	1 / 1	2019-12-11
0.52.6	1 / 1	2019-12-10
0.52.5	1 / 1	2019-12-08
0.52.4	1 / 1	2019-12-07
0.52.3	1 / 1	2019-12-07
0.52.2	1 / 1	2019-12-06
0.52.1	1 / 1	2019-12-06
0.52.0	1 / 1	2019-12-05
0.51.0	1 / 1	2019-12-05
0.50.8	1 / 1	2019-12-02

v0.81.3

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thesunny → ianstormtaylor (on 2022-07-22, known maintainer) provenance

This version was published by a different npm account (ianstormtaylor) than the most recent previously approved version (thesunny) on 2022-07-22, but ianstormtaylor is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.77.0

2 findings

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thesunny → ianstormtaylor (on 2022-04-13, known maintainer) provenance

This version was published by a different npm account (ianstormtaylor) than the most recent previously approved version (thesunny) on 2022-04-13, but ianstormtaylor is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.67.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ianstormtaylor.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thesunny → ianstormtaylor (on 2021-10-18, known maintainer) provenance

This version was published by a different npm account (ianstormtaylor) than the most recent previously approved version (thesunny) on 2021-10-18, but ianstormtaylor is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.66.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ianstormtaylor.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thesunny → ianstormtaylor (on 2021-09-13, known maintainer) provenance

This version was published by a different npm account (ianstormtaylor) than the most recent previously approved version (thesunny) on 2021-09-13, but ianstormtaylor is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.62.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: ianstormtaylor.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: thesunny → ianstormtaylor (on 2021-04-01, known maintainer) provenance

This version was published by a different npm account (ianstormtaylor) than the most recent previously approved version (thesunny) on 2021-04-01, but ianstormtaylor is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.

v0.61.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.61.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.60.0

2 findings

MEDIUM Publisher changed: damareyoh → thesunny (on 2020-11-24, unremoved on npm for 2064d) provenance

This version was published by a different npm account (thesunny) than the most recent previously approved version (damareyoh) on 2020-11-24. It has since remained available on npm for 2064 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.59.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.58.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.58.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.58.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.58.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.57.3

2 findings

MEDIUM Publisher changed: ianstormtaylor → damareyoh (on 2020-05-05, unremoved on npm for 2268d) provenance

This version was published by a different npm account (damareyoh) than the most recent previously approved version (ianstormtaylor) on 2020-05-05. It has since remained available on npm for 2268 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.57.2

2 findings

MEDIUM Publisher changed: ianstormtaylor → damareyoh (on 2020-04-24, unremoved on npm for 2278d) provenance

This version was published by a different npm account (damareyoh) than the most recent previously approved version (ianstormtaylor) on 2020-04-24. It has since remained available on npm for 2278 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.57.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.57.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.56.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.56.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.55.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.55.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.55.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.55.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.54.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.53.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.52.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.51.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.50.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.