@amplitude/rrdom
`rrdom` is a virtual dom library that is used by `rrweb` to replay DOM mutations. It is a standalone library that can be used to create a virtual dom tree and apply patches to the real dom. It's used in `rrweb` to optimize replay performance especially wh
2
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
curtisbliukelson.warnersdk.deveric_amplitudedaniel-graham-amplitudejjwang123
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): SLSA provenance present; gitHead absence is a CI config detail, not a risk signal for this org. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are @amplitude employees; normal team rotation. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainer consistent with org team changes at Amplitude. | ai | |
| typosquat | typosquat.levenshtein:jsdom | AI (typosquat): Scoped Amplitude fork of rrweb's rrdom; not impersonating jsdom, different purpose and namespace. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Forked internal package; sparse README and no keywords are expected for this type of package. | ai |
v2.1.2
2 findings
HIGH
Missing gitHead — previous versions had it
provenance
This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.