mathjax-full
1
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
mjadmin
Keywords
MathJaxmathsvgHTMLMathMLTeXAsciiMath
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in node-main.js is a documented webpack workaround to access real Node.js require; not malicious. Pattern is stable across MathJax versions. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() appears in webpack-bundled Speech Rule Engine (accessibility component); expected in bundled math/a11y libraries. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in asyncLoad/node.js is MathJax's documented async component loading mechanism, not arbitrary code execution. | ai | |
| phantom-deps | phantom-dep:esm | AI (phantom-deps): esm is a legitimate runtime dependency listed in package.json; phantom-dep flag is a false positive for this package. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 3.2.2 | 4 / 15 |
v3.2.2
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.