remark-message-control
remark plugin to enable, disable, and ignore messages with remark
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (vfile, rehype, unified, @types/mdast) are all core unified ecosystem packages maintained by the same org; adding explicit deps is normal for major version bumps in this ecosystem. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Absolute size increase is trivial (368B to ~1KB); consistent with TypeScript type additions and explicit imports in a major version refactor. | ai | |
| phantom-deps | phantom-dep:rehype | AI (phantom-deps): rehype is a unified ecosystem package declared for type/config purposes; phantom dep pattern is common in this ecosystem. | ai | |
| dependencies | unvetted-dep:@types/mdast | AI (dependencies): @types/mdast is a DefinitelyTyped type-only package standard in the remark/mdast ecosystem; not a security risk. | ai | |
| phantom-deps | phantom-dep:@types/mdast | AI (phantom-deps): @types packages are legitimately declared as deps in TypeScript ESM packages for type resolution without direct imports; stable pattern for this package. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 8.0.0 | 4 / 11 | |
| 7.1.1 | 5 / 12 | |
| 7.1.0 | 5 / 12 | |
| 7.0.0 | 6 / 12 | |
| 6.0.0 | 2 / 10 | |
| 5.0.0 | 3 / 10 | |
| 4.2.0 | 3 / 10 | |
| 4.1.1 | 3 / 10 | |
| 4.1.0 | 3 / 9 | |
| 4.0.2 | 4 / 9 | |
| 4.0.1 | 4 / 9 | |
| 4.0.0 | 4 / 9 | |
| 2.0.3 | 4 / 9 | |
| 2.0.2 | 4 / 17 | |
| 2.0.1 | 4 / 16 | |
| 2.0.0 | 3 / 16 | |
| 1.0.1 | 3 / 16 | |
| 1.0.0 | 3 / 16 |
v8.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.