mdast-util-directive
mdast extension to parse and serialize generic directives (`:cite[smith04]`)
2
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
wooormkmck
Keywords
containerdirectiveextensiongenericmarkdownmarkupmdast-utilmdastunistutilityutil
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): wooorm regularly publishes unified ecosystem packages starting at higher semver to match prior art. The kmck co-maintainer signal is a false positive for this ecosystem. Not spam or low-value. | ai | |
| dependencies | unvetted-dep:ccount | AI (dependencies): ccount is a legitimate unified ecosystem utility authored by wooorm; stable false positive for this package family. | ai | |
| dependencies | unvetted-dep:devlop | AI (dependencies): devlop is a legitimate unified ecosystem dev-helper authored by wooorm; stable false positive. | ai | |
| dependencies | unvetted-dep:@types/mdast | AI (dependencies): @types/mdast is the official TypeScript types for mdast; stable false positive for this package. | ai | |
| dependencies | unvetted-dep:parse-entities | AI (dependencies): parse-entities is a legitimate unified ecosystem package authored by wooorm. | ai | |
| dependencies | unvetted-dep:stringify-entities | AI (dependencies): stringify-entities is a legitimate unified ecosystem package authored by wooorm. | ai | |
| dependencies | unvetted-dep:mdast-util-to-markdown | AI (dependencies): mdast-util-to-markdown is a core unified/mdast ecosystem package authored by wooorm. | ai | |
| dependencies | unvetted-dep:mdast-util-from-markdown | AI (dependencies): mdast-util-from-markdown is a core unified/mdast ecosystem package authored by wooorm. | ai | |
| dependencies | unvetted-dep:unist-util-visit-parents | AI (dependencies): unist-util-visit-parents is a core unified/unist ecosystem package authored by wooorm. | ai | |
| phantom-deps | phantom-dep:@types/mdast | AI (phantom-deps): @types/mdast is a TypeScript type package loaded by convention, not direct import. Expected pattern for typed unified packages. | ai | |
| phantom-deps | phantom-dep:@types/unist | AI (phantom-deps): @types/unist is a TypeScript type package loaded by convention. Expected pattern for typed unified packages. | ai |
v2.2.4
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.