← Home

codemirror

npm Repository Homepage

Basic configuration for the CodeMirror code editor

74
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

marijn

Keywords

JavaScriptCodeMirrorEditor

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:child-process-import AI (semgrep): child_process usage is in bin/upload-release.js, a maintainer release tooling script that runs git commands — not runtime code, not a security risk for package consumers. ai
semgrep semgrep:http-module-request AI (semgrep): HTTPS request in bin/upload-release.js targets api.github.com for release uploads — standard maintainer tooling, not consumer-facing runtime code. ai
source-diff large-new-source-files AI (source-diff): codemirror (CM5) ships a large self-contained bundle of modes, addons, and core library. Large file counts are expected and stable for this package. ai
source-diff source-size-tripled AI (source-diff): CM5 bundle distribution legitimately includes hundreds of language modes and addons; large source size is expected for this package. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require in loadmode.js is a documented CM5 feature for lazy-loading language modes on demand; not a security risk for this package. ai

Versions (showing 74 of 74)

Version Deps Published
6.65.7 0 / 7
6.0.2 7 / 1
6.0.1 7 / 1
6.0.0 7 / 1
5.65.21 0 / 7
5.65.20 0 / 7
5.65.19 0 / 7
5.65.18 0 / 7
5.65.17 0 / 7
5.65.16 0 / 7
5.65.15 0 / 7
5.65.14 0 / 7
5.65.13 0 / 7
5.65.12 0 / 7
5.65.11 0 / 7
5.65.10 0 / 7
5.65.9 0 / 7
5.65.8 0 / 7
5.65.7 0 / 7
5.65.6 0 / 5
5.65.5 0 / 5
5.65.4 0 / 5
5.65.3 0 / 5
5.65.2 0 / 5
5.65.1 0 / 5
5.65.0 0 / 5
5.64.0 0 / 5
5.63.3 0 / 5
5.63.2 0 / 5
5.63.1 0 / 5
5.63.0 0 / 5
5.62.3 0 / 5
5.62.2 0 / 5
5.62.1 0 / 5
5.62.0 0 / 5
5.61.1 0 / 5
5.61.0 0 / 5
5.60.0 0 / 5
5.59.4 0 / 5
5.59.3 0 / 5
5.59.2 0 / 5
5.59.1 0 / 5
5.59.0 0 / 5
5.58.3 0 / 5
5.58.2 0 / 5
4.13.0 0 / 3
4.12.0 0 / 3
4.11.0 0 / 2
4.10.0 0 / 2
4.9.0 0 / 2
4.8.0 0 / 2
4.7.0 0 / 2
4.6.0 0 / 2
4.5.0 0 / 2
4.4.0 0 / 2
4.3.0 0 / 2
4.2.0 0 / 2
4.1.0 0 / 2
4.0.3 0 / 2
3.24.0 0 / 2
3.23.0 0 / 2
3.22.0 0 / 2
3.21.0 0 / 2
3.20.0 0 / 1
3.19.0 0 / 1
3.18.0 0 / 1
3.17.0 0 / 1
3.16.0 0 / 1
3.15.0 0 / 1
3.14.1 0 / 1
3.13.0 0 / 1
3.12.0 0 / 1
3.11.1 0 / 1
2.33.0 0 / 1

v6.65.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.65.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.64.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.63.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.63.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.63.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.63.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.62.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.62.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.62.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.62.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.61.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.61.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.60.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.59.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.59.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.59.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.59.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.59.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.58.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.58.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.