rehype-autolink-headings

rehype plugin to add links to headings

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

wooormkmck

Keywords

unifiedrehyperehype-pluginpluginheadinglinkhtml

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @ungap/structured-clone is a well-known, legitimate polyfill maintained by the ungap project. Its addition is consistent with the package's purpose and the wooorm ecosystem's upgrade patterns.	ai	2026/04/24
dependencies	unvetted-dep:@types/hast	AI (dependencies): @types/hast is a TypeScript type-definition package with no runtime code; it poses no security risk for this package.	ai	2026/04/23
phantom-deps	phantom-dep:unified	AI (phantom-deps): unified is a peer dependency in the rehype/unified ecosystem; its presence in package.json without direct import is standard practice for this plugin.	ai	2026/04/23
phantom-deps	phantom-dep:@types/hast	AI (phantom-deps): @types/hast is a type-only dependency loaded by TypeScript convention, not directly imported at runtime.	ai	2026/04/23

Versions (showing 16 of 16)

Version	Deps	Published
7.1.0	6 / 11	2023-11-08
7.0.0	6 / 11	2023-09-05
6.1.1	7 / 15	2021-12-30
6.1.0	7 / 15	2021-08-23
6.0.0	6 / 15	2021-08-02
5.1.0	4 / 16	2021-05-18
5.0.1	4 / 16	2020-11-12
4.0.0	4 / 13	2020-06-21
3.0.0	4 / 13	2020-03-15
2.0.5	4 / 13	2019-06-01
2.0.4	4 / 13	2018-11-17
2.0.3	4 / 13	2018-07-19
2.0.2	4 / 12	2017-09-18
2.0.1	4 / 12	2017-06-20
2.0.0	4 / 12	2017-02-23
1.0.0	4 / 12	2016-10-22