.changelog

github

content-v2

sha512

66f817635a5b8ab6436fcd0422592fcf03f2d34cc096817ad909df4bf53ea6f8c86070c8c4cfbc5c80ded4c84d1644ecf55d60cf1ac48a9226beb7cca019

600bb9d0df32a38d85683176e12fc7686fdcf04498c70d50e95b5945ff69044e4c2568e9d65be4953a263769311f16505d0e6fd4fcba30807b58e8fc565c

374f78aead63c221090cdd54efec97a645ed6810629dc454f5e279bf488fc5aa7833ad7ba177e97e98616204e41df877cc4356673c8cc4e2846a31a2f46d

d3865a6982d3d90efef32102cf32e4ab2f24e6ba5844ba4afa1d3827aca16e7046815b1cb0f19fb7aa7162ed1773c820cbdcef65421b5fcf0fe1debc8f80

635fce9f9e1422287154e0d9616baeb700bae157f8fd2ed50cfc8bb0f90f22f782e5d8706f28e7229ff33a785494007bd8776f434a6f33fdb51bf8303723

a1174b6ed79b44e814da28e00b59e5d58b3e4ee08dbd5a30fd92dbcbbb4d682862f1d8bf0ff1ab1fcafeaa7105349fc839655559c6707c1635443d7b7d33

9116e8c0fa9b3c12c4d440b522799085918d96439fa91e4de98a9d4c9dc1d5541fbb00b42971ae14b6a6fedf93fa2793edf47bcc283f8d38d1bb2823ee59

201b25e239e9ec5dc8029be3cb57a75414d324418407b9045ebb8107117e3e8b18154ec6b0f455e863ab758625309e9b2090170d0f7e6c289ce0da609a16

4a314dc20e7aa3a58db78fe62aa562e4328aa645c90e03e0dad72d892511528672977fedd69a6c9858fe5d0d0b71d48062b86c13ce3fe5a9651ba7905a23

4d662226d72dd59655fe73d0c105f5281cdef65564059513a71ab57a50043ba2536585f967b2ee73a1156aaa803dd8e2390ff747f41edaa5b48e0a3183e0

1850b0f4b38c8afb41ea761c70a7d88f42393c40224f1756299f292bbf2c8e788c888682c01c8b0b652060c0b629ceeb28b2954cd083d50d4d7798232a38

6b000fa31f761fefd86b4d90a4d3cd868b17f9e3920ad5cd793fff4da10eacb72b51fc16601663c7372008d5c3e6344e0eb597f89bd009593f349ed04d49

e9d400ea0cc86da1d44cc74c122e80f5d632246cf264b5be500bc3663260e432e324e3ae1c8000614d5a520ee34a2e7d052660c9af57062e84c247fa003b

b7c3ae4ff4eb8f57b27999ffcf9c9c127f4dea7378c6595891fa725794e30dc923d90198fbd688586cb8c283baabd9806227994e2d1701fd2da41ed1b14d

a2952a29075890095be9a6d12605e143815f1c958ccc3200cdd09163f3147f6086938321e467ebcc838a7d1c140160e2074254cc4b64563e219f3306075d

1bb32cfc9e4dc23fd21405a29dbfeb4444adcec669931911b2a03fdce2ee79f593d818b7843b0c4846867ca6e0d2865f9caa4b47d60d0536663999a497f5

06729ae09d699cf75bca990aad8ed326ca8528d49e83ef62c645269f17b954822580523cb1c04d7dc706dc8c3d0e083cd72d4735e01a75e3ae6ed24e8ab9

1fea619c7a970781d3f2e51f5744bbdd34f46a7fe076f6f6a922a52a073e48bcc82abf8507d9498e93219e249ca09f5fc1e2c97eeab4be1baac1146ab3ca

f4aefecbd295f500adffff5ec81b1ca0bcac60eb1eaca092db5b0534bb7c31b6753d90c17154fb3421b01430ed6bb5c023eca1b6410fc7f5a33a1d4f7873

bafac36aeac7aa221e06a074273175f425ae66ba79ef3323f1607a9d73f2caa93a3bfc2d3dad671ceee81caa210249577bf8679da417f2f5f4619ecb12af

b4f02b6f22a237f520fd29d3a04fe62f692c4876decb4c1dcdccef7e6b5a0c9bd9e107e0cb99114d9b5b3c7d5550f4fff31103b285d948b47ac71e32c1fe

18cd049d5383b73b40adc3048b300e4da07e7571f019c31d7d51dc315d038f13f81048f8b7b75e0d8ab95bc6ff59d6e3c5726df7a64774b4f55efcb850a8

577bd7668152d8f67bc8166e51fca1387be37ef98b26cb9f6d7e9899eef1a04a6a7e0086942aebe3edd63be6653e7e896c4b2035ce266e2020286c8fa9f6

57e5bdd994280f81b6c15224df1000467e3c1cf0d2dd9ba87b8462deaa16b0ba5c342d7d93d58c1dd9e16eeb890e18f76c42f43845362436389a613d2880

9c66614222df29a00620db19d2c356a8066e80e58bbd5b07a16bd6fca0d43b3b520da7db67bba9ebb5f2c4874439e99414c3f5be04d1d73b39ed3ca82b4b

35c30174cd3080cfc7a4804d11e98701ed9cad2c64d581a6e8de03646e7ef12d7a3009bdd7fe93b9ac70450768c5714ce9012c2a90c52781645245260e77

91eff313d21b3f964eefae9b191b86b0746de9a26e3602f25e202730e28f507e5a00ba91699237907b01a3d478d8bf791c74582737c39088bb6caccfb895

fa038c3e059972d26425554a9b93f4b90b8bf896fa1420a061aaa51811ef365363edbf00fe575a6f303a89e6063390696a88d46da7dabdb9c48e2da74249

3a95b5c79ec5401827593e4f1a7cfd87986697a178902d472bdc7d59114ff1dfc3dd4f4ad23dcc951f2fd5a51f783b59b8f40c324ab9132cdfa88d8dfc99

c3c33785a10f629d0cf997d255d6e278328851d60c346fb3afbff9a799239e61d14aa273029a0c0d193ad950189b2270430f8663efaf21bf9b35cb1fd6f8

05cc5d32e0bd97a4106dcb8978d5c0af9e28fdf22128722082e5b4b69e9ac4ecd5e528a466d327243df3a9c8b6d17018849abef6310e3a5eb8027637d32f

0b5091b5c33604f0061fc859020a667b813806de43315fac6520d0600d3740fce67cbe9a0d1ba6d53ade09a4237e39c02a6d059998c3175d9121fae10606

The default blueprint for ember-cli addons. 

See how Anthropic automated 95% of dependency reviews with Socket

ember-showdown-prism

The default blueprint for ember-cli addons.

real_ate

pzuraq

jenweber

melsumner

elwayman02

nickschot

jaredgalanis

minthamie

(Experimental) An ambiguous license classifier was found.

What is an ambiguous license classifier?

Ambiguous License Classifier

Source files are encoded using a non-standard text encoding.

What is bad text encoding?

Bad text encoding

Package version is not a valid semantic version (semver).

What is bad semver?

Bad semver

Package has dependencies with an invalid semantic version. This could be a sign of beta, low quality, or unmaintained dependencies.

What is bad dependency semver?

Bad dependency semver

Source files contain bidirectional unicode control characters. This could indicate a Trojan source supply chain attack. See: trojansource.codes for more information.

What are bidirectional unicode control characters?

Bidirectional unicode control characters

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack.

What is bin script confusion?

Bin script confusion

Semantic versions published out of chronological order.

What is a chronological version anomaly?

Chronological version anomaly

Project maintainer's SSH key has been compromised.

What is a compromised SSH key?

Compromised SSH key

(Experimental) Copyleft license information was found.

What do I need to know about license files?

Copyleft License

Contains a Critical Common Vulnerability and Exposure (CVE).

What is a critical CVE?

Title

Critical CVE

Contains a high severity Common Vulnerability and Exposure (CVE).

What is a CVE?

High CVE

Uses debug, reflection and dynamic code execution features.

What is debug access?

Debug access

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

What is a deprecated package?

Deprecated

(Experimental) Contains a known deprecated SPDX license exception.

What is a deprecated SPDX exception?

Deprecated SPDX exception

(Experimental) License is deprecated which may have legal implications regarding the package's use.

What is a deprecated license?

Deprecated license

Package name is similar to other popular packages and may not be the package you want.

What is a typosquat?

Possible typosquat attack

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

What is dynamic require?

Dynamic require

Package does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.

What is an empty package?

Empty package

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

What is environment variable access?

Environment variable access

(Experimental) Something was found which is explicitly marked as unlicensed.

Explicitly Unlicensed Item

Package optionally loads a dependency which is not specified within any of the package.json dependency fields. It may inadvertently be importing dependencies specified by other packages.

What are extraneous dependencies?

Name

Extraneous dependency

Contains a dependency which resolves to a file. This can obfuscate analysis and serves no useful purpose.

What are file dependencies?

File dependency

Accesses the file system, and could potentially read sensitive data.

What is filesystem access?

Filesystem access

Package has a dependency with a floating version range. This can cause issues if the dependency publishes a new major version.

What are wildcard dependencies?

Wildcard dependency

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable and can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are git dependencies?

Git dependency

Contains a dependency which resolves to a GitHub URL. Dependencies fetched from GitHub specifiers are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

What are GitHub dependencies?

GitHub dependency

AI has identified unusual behaviors that may pose a security risk.

What is an AI-detected potential code anomaly?

AI-detected potential code anomaly

AI has identified this package as a potential typosquat of a more popular package. This suggests that the package may be intentionally mimicking another package's name, description, or other metadata.

What is AI-detected potential typosquatting?

AI-detected possible typosquat

AI has identified this package as malware. This is a strong signal that the package may be malicious.

What is AI-detected potential malware?

AI-detected potential malware

AI has determined that this package may contain potential security issues or vulnerabilities.

What are AI-detected potential security risks?

AI-detected potential security risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Why is native code a concern?

Native code

Contains high entropy strings. This could be a sign of encrypted data, leaked secrets or obfuscated code.

What are high entropy strings?

High entropy strings

Contains unicode homoglyphs which can be used in supply chain confusion attacks.

What are unicode homoglyphs?

Unicode homoglyphs

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

What are http dependencies?

HTTP dependency

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

What is an install script?

Install scripts

Package has an invalid manifest file and can cause installation problems if you try to use it.

What is an invalid manifest file?

Invalid manifest file

Source files contain invisible characters. This could indicate source obfuscation or a supply chain attack.

What are invisible characters?

Invisible chars

(Experimental) Package license has recently changed.

What is a license change?

License change

(Experimental) Contains an SPDX license exception.

What is a license exception?

License exception

This package is not allowed per your license policy. Review the package's license to ensure compliance.

What is a license policy violation?

License Policy Violation

Contains long string literals, which may be a sign of obfuscated or packed code.

What's wrong with long strings?

Long strings

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

What is a major refactor?

Major refactor

This package is malware. We have asked the package registry to remove it.

What is known malware?

Known malware

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

What is manifest confusion?

Manifest confusion

Contains a medium severity Common Vulnerability and Exposure (CVE).

What is a medium CVE?

Medium CVE

Contains a low severity Common Vulnerability and Exposure (CVE).

What is a mild CVE?

Low CVE

This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.

What's wrong with minified code?

Minified code

(Experimental) A package's licensing information has fine-grained problems.

Misc. License Issues

The package was published by an npm account that no longer exists.

What is a non-existent author?

Non-existent author

A required dependency is not declared in package.json and may prevent the package from working.

What is a missing dependency?

Missing dependency

(Experimental) Package does not have a license and consumption legal status is unknown.

ember-showdown-prism - npm Package File explorer