@vscode/emmet-helper
Helper to use emmet modules in Visual Studio Code
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Established Microsoft package published by vscode-bot with strong track record; missing gitHead likely reflects a CI/CD pipeline change, not a security concern. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Legitimate Microsoft VS Code tooling package; short README and no keywords are cosmetic issues, not spam indicators. | ai | |
| source-diff | obfuscated-file:lib/esm/data.js | AI (source-diff): lib/esm/data.js is a minified CSS data dictionary (property names/values for Emmet completion). Long lines are data, not obfuscation. Stable false positive for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): rebornix is a known Microsoft/VSCode team member. Addition is a legitimate internal team change within the Microsoft ecosystem. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from vscode-bot to microsoft1es is a legitimate Microsoft internal transition; microsoft1es is a well-established Microsoft publishing account with 3390 approved packages. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 2.11.0 | 5 / 5 | |
| 2.10.0 | 5 / 5 | |
| 2.9.3 | 5 / 6 | |
| 2.9.2 | 5 / 6 | |
| 2.9.1 | 5 / 6 | |
| 2.9.0 | 5 / 6 | |
| 2.8.9 | 5 / 6 | |
| 2.8.8 | 5 / 6 | |
| 2.8.7 | 5 / 6 | |
| 2.8.6 | 5 / 6 | |
| 2.8.5 | 5 / 6 | |
| 2.8.4 | 6 / 5 | |
| 2.8.3 | 6 / 5 | |
| 2.8.2 | 6 / 5 | |
| 2.8.1 | 6 / 5 | |
| 2.8.0 | 6 / 5 | |
| 2.7.0 | 6 / 5 |
v2.11.0
2 findingsThis version was published by a different npm account than previous versions on 2024-11-20. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.10.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.9
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: vscode-bot.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.8
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: vscode-bot.
v2.8.7
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: vscode-bot.
v2.8.6
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: vscode-bot.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.5
3 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: vscode-bot.
[Accepted risk] This version was published by a different npm account than previous versions on 2022-12-28. This could indicate a legitimate maintainer transition or an account compromise.
v2.8.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.