@codemirror/view — Greenflagged

DOM view component for the CodeMirror code editor

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

marijn

Keywords

editorcode

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	encoded-string-file:dist/index.cjs	AI (source-diff): Long strings are Unicode BiDi character type lookup tables (LowTypes/ArabicTypes), a documented and stable pattern in CodeMirror's bidi text rendering code. Not malicious.	ai	2026/04/23
source-diff	encoded-string-file:dist/index.js	AI (source-diff): Long strings are Unicode BiDi character type lookup tables (LowTypes/ArabicTypes), a documented and stable pattern in CodeMirror's bidi text rendering code. Not malicious.	ai	2026/04/23
dependencies	unvetted-dep:style-mod	AI (dependencies): style-mod is a well-known CodeMirror ecosystem package by the same author; stable dependency across all @codemirror/view versions.	ai	2026/04/21
typosquat	typosquat.levenshtein:vite	AI (typosquat): @codemirror/view is a legitimate, long-established CodeMirror 6 package by Marijn Haverbeke; the Levenshtein match to 'vite' is purely coincidental and not a typosquat.	ai	2026/04/21
dependencies	unvetted-dep:@codemirror/state	AI (dependencies): @codemirror/state is the core state package of the CodeMirror 6 ecosystem by the same author; stable and expected dependency.	ai	2026/04/21
dependencies	unvetted-dep:w3c-keyname	AI (dependencies): w3c-keyname is a well-known CodeMirror ecosystem package by the same author; stable dependency across all @codemirror/view versions.	ai	2026/04/21
dependencies	unvetted-dep:crelt	AI (dependencies): crelt is a well-known CodeMirror ecosystem utility by the same author; stable dependency across all @codemirror/view versions.	ai	2026/04/21

Versions (showing 51 of 238)

View all versions

Version	Deps	Published
6.43.0	4 / 1	2026-05-14
6.42.1	4 / 1	2026-05-07
6.42.0	4 / 1	2026-05-06
6.41.1	4 / 1	2026-04-18
6.41.0	4 / 1	2026-04-01
6.40.0	4 / 1	2026-03-12
6.39.17	4 / 1	2026-03-10
6.39.16	4 / 1	2026-03-02
6.39.15	4 / 1	2026-02-20
6.39.14	4 / 1	2026-02-12
6.39.13	4 / 1	2026-02-08
6.39.12	4 / 1	2026-01-30
6.39.11	4 / 1	2026-01-14
6.39.10	4 / 1	2026-01-13
6.39.9	4 / 1	2026-01-06
6.39.8	4 / 1	2025-12-30
6.39.7	4 / 1	2025-12-24
6.39.6	4 / 1	2025-12-23
6.39.5	4 / 1	2025-12-22
6.39.4	4 / 1	2025-12-12
6.39.3	4 / 1	2025-12-11
6.39.2	4 / 1	2025-12-09
6.39.1	4 / 1	2025-12-09
6.39.0	4 / 1	2025-12-08
6.38.8	4 / 1	2025-11-17
6.38.7	4 / 1	2025-11-14
6.38.6	4 / 1	2025-10-13
6.38.5	4 / 1	2025-10-07
6.38.4	4 / 1	2025-09-28
6.38.3	4 / 1	2025-09-22
6.38.2	4 / 1	2025-09-01
6.38.1	4 / 1	2025-07-15
6.38.0	4 / 1	2025-06-27
6.37.2	4 / 1	2025-06-12
6.37.1	4 / 1	2025-05-30
6.37.0	3 / 1	2025-05-29
6.36.8	3 / 1	2025-05-12
6.36.7	3 / 1	2025-05-02
6.36.6	3 / 1	2025-04-24
6.36.5	3 / 1	2025-03-29
6.36.4	3 / 1	2025-03-03
6.36.3	3 / 1	2025-02-18
6.36.2	3 / 1	2025-01-09
6.36.1	3 / 1	2024-12-19
6.36.0	3 / 1	2024-12-17
6.35.3	3 / 1	2024-12-09
6.35.2	3 / 1	2024-12-06
6.35.1	3 / 1	2024-12-06
6.35.0	3 / 1	2024-11-21
6.34.3	3 / 1	2024-11-15
6.34.2	3 / 1	2024-11-05

v6.43.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.42.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.42.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.41.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.40.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.39.0

3 findings

HIGH Long encoded string in modified file: dist/index.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.8

3 findings

HIGH Long encoded string in modified file: dist/index.cjs source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.38.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.38.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.37.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.37.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.37.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.36.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.36.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.35.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.35.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.35.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.35.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.34.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.34.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.