vscode-emmet-helper
Helper to use emmet modules in Visual Studio Code
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:out/data.js | AI (source-diff): out/data.js is a minified CSS property data dictionary, expected for an Emmet helper library. Long lines are dense data serialization, not obfuscation or malicious code. | ai | |
| source-diff | obfuscated-file:lib/cjs/data.js | AI (source-diff): File contains minified CSS/HTML property name arrays for Emmet completion data — not obfuscated malicious code. Long lines are large string arrays, stable for this package. | ai | |
| source-diff | obfuscated-file:lib/esm/data.js | AI (source-diff): ESM variant of the same Emmet completion data file — minified CSS/HTML property arrays, not obfuscated malicious code. Stable for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate Microsoft internal maintainer transition; raymondzhao is a known VS Code team member with 187 approved packages and the repo remains under the Microsoft GitHub org. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): aeschli, octref, and raymondzhao are all recognized Microsoft/VS Code ecosystem contributors; this is a legitimate team maintainer setup. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Well-established Microsoft utility package with 152 versions and 49k weekly downloads; sparse README and missing keywords are cosmetic, not indicative of spam or malice. | ai |
Versions (showing 43 of 143)
| Version | Deps | Published |
|---|---|---|
| 1.0.12 | 2 / 4 | |
| 1.0.11 | 2 / 4 | |
| 1.0.10 | 2 / 3 | |
| 1.0.9 | 2 / 3 | |
| 1.0.8 | 2 / 3 | |
| 1.0.7 | 2 / 3 | |
| 1.0.6 | 2 / 3 | |
| 1.0.5 | 2 / 3 | |
| 1.0.4 | 3 / 3 | |
| 1.0.3 | 3 / 3 | |
| 1.0.2 | 3 / 3 | |
| 1.0.1 | 3 / 3 | |
| 1.0.0 | 3 / 3 | |
| 0.0.30 | 3 / 3 | |
| 0.0.29 | 3 / 3 | |
| 0.0.28 | 3 / 3 | |
| 0.0.27 | 3 / 2 | |
| 0.0.26 | 3 / 2 | |
| 0.0.25 | 3 / 2 | |
| 0.0.24 | 3 / 2 | |
| 0.0.23 | 3 / 2 | |
| 0.0.22 | 3 / 2 | |
| 0.0.21 | 3 / 2 | |
| 0.0.20 | 3 / 2 | |
| 0.0.19 | 3 / 2 | |
| 0.0.18 | 2 / 2 | |
| 0.0.17 | 2 / 2 | |
| 0.0.16 | 2 / 2 | |
| 0.0.15 | 2 / 2 | |
| 0.0.14 | 2 / 2 | |
| 0.0.13 | 2 / 2 | |
| 0.0.12 | 2 / 2 | |
| 0.0.11 | 2 / 2 | |
| 0.0.10 | 2 / 2 | |
| 0.0.9 | 2 / 2 | |
| 0.0.8 | 2 / 2 | |
| 0.0.7 | 2 / 2 | |
| 0.0.6 | 2 / 2 | |
| 0.0.5 | 2 / 2 | |
| 0.0.4 | 2 / 2 | |
| 0.0.3 | 2 / 2 | |
| 0.0.2 | 2 / 2 | |
| 0.0.1 | 2 / 3 |
v1.0.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.