refractor
Lightweight, robust, elegant virtual syntax highlighting using Prism
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:lang/keepalived.js | AI (source-diff): Prism language grammar with long regexes for IP matching; not obfuscation. Stable pattern for lang/ files. | ai | |
| source-diff | obfuscated-file:lang/cobol.js | AI (source-diff): Long regex lines in Prism language grammars, not obfuscation; stable pattern for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @types/hast and @types/prismjs are TypeScript type packages used as phantom/type-only deps; stable pattern for this package's TypeScript support. | ai | |
| source-diff | large-new-source-files | AI (source-diff): refractor regularly adds new language files to lang/ directory; large numbers of new source files is expected and benign for this package. | ai | |
| dependencies | unvetted-dep:prismjs | AI (dependencies): prismjs is the core dependency refractor is explicitly built around; its inclusion is intentional and documented. Not a risk for this package. | ai | |
| dependencies | unvetted-dep:@types/hast | AI (dependencies): @types/hast is a DefinitelyTyped type package used throughout the hast/unified ecosystem; no security risk for this package. | ai | |
| phantom-deps | phantom-dep:@types/hast | AI (phantom-deps): @types/hast is a TypeScript type package declared as a runtime dep for consumer type inference; not directly imported in JS is expected behavior for this package. | ai | |
| phantom-deps | phantom-dep:@types/prismjs | AI (phantom-deps): @types/prismjs is a TypeScript type package; not being directly imported in JS is expected and stable for this package. | ai |
Versions (showing 42 of 42)
| Version | Deps | Published |
|---|---|---|
| 5.0.0 | 4 / 21 | |
| 4.9.0 | 4 / 21 | |
| 4.8.1 | 4 / 23 | |
| 4.8.0 | 4 / 28 | |
| 4.7.0 | 4 / 28 | |
| 4.6.0 | 5 / 26 | |
| 4.5.0 | 5 / 26 | |
| 4.4.0 | 5 / 26 | |
| 4.3.0 | 5 / 26 | |
| 4.2.2 | 5 / 26 | |
| 4.2.1 | 5 / 26 | |
| 4.2.0 | 5 / 26 | |
| 4.1.1 | 5 / 26 | |
| 4.1.0 | 5 / 26 | |
| 4.0.0 | 5 / 25 | |
| 3.6.0 | 3 / 23 | |
| 3.5.0 | 3 / 23 | |
| 3.4.0 | 3 / 23 | |
| 3.3.1 | 3 / 22 | |
| 3.3.0 | 3 / 22 | |
| 3.2.0 | 3 / 22 | |
| 3.1.0 | 3 / 22 | |
| 3.0.0 | 3 / 22 | |
| 2.10.1 | 3 / 22 | |
| 2.10.0 | 3 / 23 | |
| 2.9.0 | 3 / 23 | |
| 2.8.0 | 3 / 23 | |
| 2.7.0 | 3 / 23 | |
| 2.6.2 | 3 / 23 | |
| 2.6.1 | 3 / 23 | |
| 2.6.0 | 3 / 23 | |
| 2.5.0 | 3 / 23 | |
| 2.4.1 | 2 / 22 | |
| 2.4.0 | 2 / 22 | |
| 2.3.0 | 2 / 22 | |
| 2.2.0 | 2 / 22 | |
| 2.1.0 | 2 / 22 | |
| 2.0.0 | 2 / 22 | |
| 1.1.0 | 2 / 22 | |
| 1.0.2 | 2 / 22 | |
| 1.0.1 | 1 / 23 | |
| 1.0.0 | 1 / 23 |
v5.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.9.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.5.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.4.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.