@emmetio/markup-formatters
Formats and outputs Emmet abbreviation in different markup languages (HTML, XML, Slim, Pug etc)
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-takeover | AI (maintainer-change): serge.che is the original Emmet author (Sergey Chikuyonok); the transition from 'emmetio' to 'serge.che'/'emmetio-user' is a legitimate account reorganization, not a hijack. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher serge.che is the original package author per package.json; change reflects account reorganization, not compromise. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers (serge.che, emmetio-user) are the original author and an org account; legitimate transition. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removal of 'emmetio' account is part of the same legitimate reorganization by the original author. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Dormancy explained by maintainer account reorganization; no suspicious code changes accompany the resumed publishing. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 0.4.1 | 2 / 5 | |
| 0.4.0 | 2 / 5 | |
| 0.3.3 | 2 / 7 | |
| 0.3.2 | 2 / 7 | |
| 0.3.1 | 2 / 7 | |
| 0.3.0 | 2 / 7 | |
| 0.2.1 | 1 / 8 | |
| 0.2.0 | 1 / 8 | |
| 0.1.0 | 1 / 8 |
v0.4.1
3 findingsAll previous maintainers (emmetio) were replaced by new maintainers (emmetio-user, serge.che). This is a strong signal of a potential package hijack and requires careful review.
This version was published by a different npm account than previous versions on 2018-12-03. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.