remark-parse — Greenflagged

remark plugin to add support for parsing markdown input

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

johnowooorm

Keywords

abstractastmarkdownmdastparsepluginremarkremark-pluginsyntaxtreeunified

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
email-domain	unclaimed-email:spektrakel.de	AI (email-domain): The spektrakel.de email belongs to a contributor, not the primary publisher (wooorm). The package is published by a highly trusted maintainer with 2164 approved packages. Risk is low and stable across versions.	ai	2026/04/22
publish-pattern	dormant-publish	AI (publish-pattern): remark-parse v10 was a major architectural rewrite delegating parsing to mdast-util-from-markdown; the gap reflects intentional ecosystem restructuring by the canonical maintainer wooorm, not account takeover.	ai	2026/04/22
maintainer-change	maintainer-added	AI (maintainer-change): remark-parse is a large open-source project under the remarkjs org; multiple maintainer additions reflect legitimate community growth, not a suspicious takeover.	ai	2026/04/22
npm-metadata	suspicious-initial-version	AI (npm-metadata): remark-parse 0.0.0 is a legitimate placeholder version in the wooorm/remark monorepo ecosystem, not a throwaway malicious package. Publisher wooorm is highly trusted with 2000+ approved packages.	ai	2026/04/22
source-diff	source-size-dropped	AI (source-diff): Size drop reflects intentional refactor: parsing logic moved to mdast-util-from-markdown; remark-parse v10 is a thin plugin wrapper by design.	ai	2026/04/22
publish-pattern	new-deps-added	AI (publish-pattern): New deps (unified, mdast-util-from-markdown, @types/mdast) are core unified-ecosystem packages by the same maintainer, introduced as part of the well-documented remark v10 architectural rewrite.	ai	2026/04/22
dependencies	unvetted-dep:micromark-util-types	AI (dependencies): micromark-util-types is a core package in the micromark ecosystem (same author, wooorm), used as the foundation for remark's modern parser stack.	ai	2026/04/22
dependencies	unvetted-dep:@types/mdast	AI (dependencies): @types/mdast is a core TypeScript types package in the unified/mdast ecosystem, maintained by the same author (wooorm). Stable dependency for this package.	ai	2026/04/22
dependencies	unvetted-dep:mdast-util-from-markdown	AI (dependencies): mdast-util-from-markdown is the canonical markdown-to-mdast utility in the unified ecosystem, maintained by wooorm. Expected dependency for remark-parse v11+.	ai	2026/04/22
dependencies	unvetted-dep:unist-util-remove-position	AI (dependencies): unist-util-remove-position is a core unified ecosystem utility by wooorm; stable and benign.	ai	2026/04/22
dependencies	unvetted-dep:trim	AI (dependencies): trim is a long-standing small utility used throughout the unified/remark ecosystem; no malicious history.	ai	2026/04/22
dependencies	unvetted-dep:unherit	AI (dependencies): unherit is a wooorm-authored utility package integral to the unified ecosystem; stable and benign.	ai	2026/04/22
dependencies	unvetted-dep:state-toggle	AI (dependencies): state-toggle is a tiny wooorm utility used across the unified ecosystem; no risk indicators.	ai	2026/04/22
dependencies	unvetted-dep:markdown-escapes	AI (dependencies): markdown-escapes is a wooorm-authored utility specific to the remark/unified ecosystem; benign.	ai	2026/04/22
dependencies	unvetted-dep:is-word-character	AI (dependencies): is-word-character is a small wooorm utility for character classification; no risk indicators.	ai	2026/04/22
dependencies	unvetted-dep:trim-trailing-lines	AI (dependencies): trim-trailing-lines is a tiny wooorm utility; stable and benign.	ai	2026/04/22
dependencies	unvetted-dep:is-whitespace-character	AI (dependencies): is-whitespace-character is a small wooorm utility for character classification; no risk indicators.	ai	2026/04/22
phantom-deps	phantom-dep:@types/mdast	AI (phantom-deps): @types/mdast is intentionally declared as a runtime dep in the unified ecosystem for TypeScript type re-exports; not a real phantom dependency for this package.	ai	2026/04/21
provenance	no-provenance	AI (provenance): wooorm is the canonical remark maintainer with a strong track record; lack of provenance is not a meaningful risk signal here.	ai	2026/04/21