rehype-minify-whitespace
rehype plugin to collapse whitespace
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): unified and @types/hast are core rehype/unified ecosystem packages; their addition is expected for a TypeScript-migrated rehype plugin and poses no supply chain risk. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop reflects deliberate refactor: logic extracted into hast-util-minify-whitespace dependency. Pattern is stable for this package's evolution. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): remcohaszing is a known contributor to the unified/rehype ecosystem; addition is a legitimate maintainer expansion, not a suspicious takeover. | ai | |
| phantom-deps | phantom-dep:@types/hast | AI (phantom-deps): @types/hast is intentionally declared as a runtime dep in this package to ship TypeScript type definitions; it is not a phantom dep in the traditional sense. | ai | |
| dependencies | unvetted-dep:@types/hast | AI (dependencies): @types/hast is a standard DefinitelyTyped type package used for TypeScript types in the unified/rehype ecosystem; stable and benign for this package. | ai | |
| provenance | no-provenance | AI (provenance): wooorm is a long-standing, highly trusted publisher; lack of Sigstore provenance is a process gap, not a security risk for this package. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 6.0.2 | 2 / 0 | |
| 6.0.1 | 2 / 0 | |
| 6.0.0 | 5 / 0 | |
| 5.0.1 | 6 / 0 | |
| 5.0.0 | 6 / 0 | |
| 4.0.5 | 4 / 0 | |
| 4.0.4 | 5 / 0 | |
| 4.0.3 | 5 / 0 | |
| 4.0.2 | 5 / 0 | |
| 4.0.1 | 8 / 0 | |
| 4.0.0 | 8 / 0 | |
| 3.0.0 | 8 / 0 | |
| 2.0.4 | 8 / 0 | |
| 2.0.3 | 8 / 0 | |
| 2.0.2 | 8 / 0 | |
| 2.0.1 | 8 / 0 | |
| 2.0.0 | 8 / 0 | |
| 1.1.0 | 8 / 0 | |
| 1.0.0 | 8 / 0 |
v6.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v6.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.