gatsby-mdx — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

avigoldman

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:mime	AI (phantom-deps): mime is declared and used indirectly in Gatsby plugin config; legitimate indirect dependency pattern.	ai	2026/04/24
phantom-deps	phantom-dep:pretty-bytes	AI (phantom-deps): pretty-bytes is declared and used indirectly in Gatsby plugin config; legitimate indirect dependency pattern.	ai	2026/04/24
phantom-deps	phantom-dep:unist-util-map	AI (phantom-deps): unist-util-map is declared and used indirectly in Gatsby plugin config; legitimate indirect dependency pattern.	ai	2026/04/24
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is the standard Gatsby plugin resolution mechanism; this is intentional and documented behavior for gatsby-mdx.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function() in mdx-renderer.js is the core MDX runtime evaluation mechanism — intentional design of MDX renderers, not a security risk in this context.	ai	2026/04/24
dependencies	unvetted-dep:mdast-util-to-string	AI (dependencies): mdast-util-to-string is a well-known, stable utility in the unified/remark ecosystem; stable false positive for this package.	ai	2026/04/24

Versions (showing 13 of 13)

Version	Deps	Published
1.0.0	0 / 0	2019-07-25
0.6.0	25 / 2	2019-04-12
0.5.2	20 / 2	2019-03-06
0.4.4	20 / 2	2019-03-21
0.3.3	19 / 2	2019-01-08
0.3.2	18 / 2	2019-01-03
0.1.3	19 / 2	2018-09-01
0.0.7	12 / 0	2018-08-06
0.0.6	12 / 0	2018-08-01
0.0.5	12 / 0	2018-07-29
0.0.4	11 / 0	2018-07-27
0.0.3	2 / 0	2018-07-25
0.0.2	1 / 0	2018-07-25