@mintlify/prebuild
Helpful functions for Mintlify's prebuild step
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are Mintlify employees (ruhanponnada, kathrynmintlify, kylefinken); org-internal change. | ai | |
| license | uncommon-license:Elastic-2.0 | AI (license): Elastic-2.0 is Mintlify's standard license across their packages. | ai | |
| provenance | publisher-changed | AI (provenance): Transition from individual account to GitHub Actions CI publishing; consistent with org CI/CD migration. | ai | |
| phantom-deps | phantom-dep:gray-matter | AI (phantom-deps): gray-matter is referenced in config files but not directly imported; consistent with other accepted phantom deps in this package. | ai | |
| provenance | no-provenance | AI (provenance): Provenance attestation is uncommon across npm (~12%); absence is not a security disqualifier for this established package. | ai | |
| phantom-deps | phantom-dep:front-matter | AI (phantom-deps): Legitimate package; phantom detection likely due to indirect/type-level usage in a TypeScript build context. | ai | |
| dependencies | unvetted-dep:favicons | AI (dependencies): favicons is a well-known, legitimate favicon generation library; appropriate dependency for a documentation prebuild tool. | ai | |
| dependencies | unvetted-dep:sharp-ico | AI (dependencies): sharp-ico is a legitimate ICO format plugin for the sharp image library, which is also a direct dep; appropriate for favicon/image processing in prebuild. | ai | |
| phantom-deps | phantom-dep:openapi-types | AI (phantom-deps): Legitimate types-only package; phantom detection expected for type-only imports in TypeScript projects. | ai | |
| phantom-deps | phantom-dep:unist-util-visit | AI (phantom-deps): Legitimate unist utility; phantom detection likely due to indirect usage pattern in TypeScript build. | ai | |
| dependencies | unvetted-dep:@mintlify/common | AI (dependencies): Same-org scoped package from Mintlify; expected internal dependency across all @mintlify/* packages. | ai | |
| phantom-deps | phantom-dep:@mintlify/openapi-parser | AI (phantom-deps): Same-org package; phantom dep finding is a code quality note, not a security risk for this package. | ai | |
| dependencies | unvetted-dep:@mintlify/openapi-parser | AI (dependencies): Same-org scoped package from Mintlify; expected internal dependency across all @mintlify/* packages. | ai | |
| dependencies | unvetted-dep:@mintlify/validation | AI (dependencies): Same-org scoped package from Mintlify; expected internal dependency across all @mintlify/* packages. | ai | |
| dependencies | unvetted-dep:@mintlify/scraping | AI (dependencies): Same-org scoped package from Mintlify; expected internal dependency across all @mintlify/* packages. | ai |
Versions (showing 48 of 549)
| Version | Deps | Published |
|---|---|---|
| 1.0.515 | 13 / 13 | |
| 1.0.514 | 13 / 13 | |
| 1.0.513 | 13 / 13 | |
| 1.0.512 | 13 / 13 | |
| 1.0.511 | 13 / 13 | |
| 1.0.510 | 13 / 13 | |
| 1.0.509 | 13 / 13 | |
| 1.0.508 | 13 / 13 | |
| 1.0.507 | 13 / 13 | |
| 1.0.506 | 13 / 13 | |
| 1.0.505 | 13 / 13 | |
| 1.0.504 | 13 / 13 | |
| 1.0.503 | 13 / 13 | |
| 1.0.502 | 13 / 13 | |
| 1.0.501 | 13 / 13 | |
| 1.0.500 | 13 / 13 | |
| 1.0.499 | 13 / 13 | |
| 1.0.498 | 13 / 13 | |
| 1.0.497 | 13 / 13 | |
| 1.0.496 | 13 / 13 | |
| 1.0.495 | 13 / 13 | |
| 1.0.494 | 13 / 13 | |
| 1.0.493 | 14 / 13 | |
| 1.0.492 | 14 / 13 | |
| 1.0.491 | 14 / 13 | |
| 1.0.490 | 14 / 13 | |
| 1.0.489 | 14 / 13 | |
| 1.0.488 | 14 / 13 | |
| 1.0.487 | 14 / 13 | |
| 1.0.486 | 14 / 13 | |
| 1.0.485 | 14 / 13 | |
| 1.0.484 | 14 / 13 | |
| 1.0.483 | 14 / 13 | |
| 1.0.482 | 14 / 13 | |
| 1.0.481 | 14 / 13 | |
| 1.0.480 | 14 / 13 | |
| 1.0.479 | 14 / 13 | |
| 1.0.478 | 14 / 13 | |
| 1.0.477 | 14 / 13 | |
| 1.0.476 | 14 / 13 | |
| 1.0.475 | 14 / 13 | |
| 1.0.474 | 14 / 13 | |
| 1.0.473 | 14 / 13 | |
| 1.0.472 | 13 / 13 | |
| 1.0.471 | 13 / 13 | |
| 1.0.470 | 13 / 13 | |
| 1.0.469 | 13 / 13 | |
| 1.0.468 | 13 / 13 |
v1.0.515
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.514
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.513
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.512
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.511
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.510
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.509
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.508
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.507
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.506
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.505
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.504
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.503
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.502
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.501
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.500
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.499
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.498
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.497
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.496
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.495
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.494
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.493
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.492
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.491
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.490
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.489
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.488
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.487
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.486
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.485
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.484
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.483
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.482
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.481
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.480
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.479
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.478
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.477
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.476
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.475
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.474
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.473
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.472
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.471
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.470
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.469
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.468
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.