@compodoc/compodoc — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

compodoc

Keywords

angular2angulardocumentationcomponentsmodulegraphdependenciesmarkdown

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:postinstall	AI (install-scripts): opencollective-postinstall is a well-known donation-prompt pattern with \|\| exit 0 fallback; stable for this package.	ai	2026/05/12
phantom-deps	phantom-dep:opencollective-postinstall	AI (phantom-deps): Used only in postinstall script, not imported; expected pattern.	ai	2026/05/12
phantom-deps	phantom-dep:vis	AI (phantom-deps): Frontend asset bundled into generated docs, not directly imported in JS source.	ai	2026/05/12
phantom-deps	phantom-dep:tablesort	AI (phantom-deps): Frontend asset bundled into generated docs, not directly imported in JS source.	ai	2026/05/12
phantom-deps	phantom-dep:bootstrap.native	AI (phantom-deps): Frontend asset bundled into generated docs, not directly imported in JS source.	ai	2026/05/12
phantom-deps	phantom-dep:svg-pan-zoom	AI (phantom-deps): Frontend asset bundled into generated docs, not directly imported in JS source.	ai	2026/05/12
phantom-deps	phantom-dep:prismjs	AI (phantom-deps): Frontend asset bundled into generated docs, not directly imported in JS source.	ai	2026/05/12
phantom-deps	phantom-dep:loglevel	AI (phantom-deps): Likely used indirectly via loglevel-plugin-prefix or config; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:loglevel-plugin-prefix	AI (phantom-deps): Loaded by convention/config, not direct import; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:glob	AI (phantom-deps): Used via config/build tooling; stable false positive for this package.	ai	2026/05/12
phantom-deps	phantom-dep:colors	AI (phantom-deps): Logging utility; likely loaded indirectly; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:es6-shim	AI (phantom-deps): Polyfill loaded by convention, not direct import; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:@babel/preset-env	AI (phantom-deps): Framework-scoped, loaded by Babel config convention; stable false positive.	ai	2026/05/12
phantom-deps	phantom-dep:@babel/plugin-transform-private-methods	AI (phantom-deps): Framework-scoped, loaded by Babel config convention; stable false positive.	ai	2026/05/12

Versions (showing 1 of 1)

Version	Deps	Published
1.1.26	39 / 0	2024-10-14

v1.1.26

2 findings

HIGH Package has 'postinstall' script install-scripts

Script: opencollective-postinstall || exit 0

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.