rehype
HTML processor powered by plugins part of the unified collective
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @types/hast is a pure TypeScript type definitions package with no executable code; its addition as a runtime dep is standard practice in the unified/rehype ecosystem for type re-exports. | ai | |
| dependencies | unvetted-dep:@types/hast | AI (dependencies): @types/hast is a DefinitelyTyped type-definition package used for TypeScript type exports in the unified ecosystem; no executable risk. | ai | |
| phantom-deps | phantom-dep:@types/hast | AI (phantom-deps): @types/hast is a type-only dependency loaded by convention in the unified/rehype ecosystem; not a hidden code execution concern. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): remcohaszing is a known contributor in the unified/rehype ecosystem; addition is consistent with legitimate team expansion. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 13.0.2 | 4 / 0 | |
| 13.0.1 | 4 / 0 | |
| 13.0.0 | 4 / 0 | |
| 12.0.1 | 4 / 0 | |
| 12.0.0 | 4 / 0 | |
| 11.0.0 | 3 / 0 | |
| 10.0.0 | 3 / 0 | |
| 9.0.1 | 3 / 0 | |
| 9.0.0 | 3 / 0 | |
| 8.0.0 | 3 / 0 | |
| 7.0.0 | 3 / 0 | |
| 6.0.0 | 3 / 0 | |
| 5.0.1 | 3 / 0 | |
| 5.0.0 | 3 / 0 | |
| 4.0.0 | 3 / 0 | |
| 3.0.0 | 3 / 0 | |
| 2.0.0 | 3 / 0 | |
| 1.0.0 | 4 / 0 |
v13.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.