@bytecodealliance/componentize-js No license 36 versions

@bytecodealliance/componentize-js

npm Repository Homepage

ESM -> WebAssembly Component creator, via a SpiderMonkey JS engine embedding

36

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

tschneidereitcfallinguybedfordvados

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@jakechampion/wizer	AI (dependencies): Known BytecodeAlliance-adjacent wasm tooling dep, needed for wasm build pipeline.	ai	2026/07/21
dependencies	unvetted-dep:@cfallin/weval	AI (dependencies): weval is the documented weval-based build path for this tool.	ai	2026/07/08
npm-metadata	bundled-binaries	AI (npm-metadata): Core .wasm embedding artifacts are the package's stated function.	ai	2026/07/08
semgrep	semgrep:base64-decode	AI (semgrep): base64Compile is used to compile embedded WebAssembly binaries from base64 strings — a standard pattern for WASM embedding in JS. Entirely expected for a SpiderMonkey/WASM componentization tool.	ai	2026/04/25
phantom-deps	phantom-dep:es-module-lexer	AI (phantom-deps): es-module-lexer is a declared runtime dependency; phantom-dep finding reflects indirect usage pattern, not a security concern for this package.	ai	2026/04/25

Versions (showing 36 of 36)

Version	Deps	Published
0.21.0	5 / 4	2026-05-20
0.20.0	5 / 4	2026-04-14
0.19.3	4 / 4	2025-10-27
0.19.2	4 / 4	2025-10-17
0.19.1	4 / 4	2025-09-17
0.19.0	4 / 4	2025-09-08
0.18.5	5 / 4	2025-08-28
0.18.4	5 / 4	2025-07-23
0.18.3	5 / 4	2025-07-16
0.18.2	4 / 3	2025-04-10
0.18.1	4 / 3	2025-04-07
0.18.0	4 / 2	2025-03-24
0.17.0	4 / 2	2025-02-22
0.16.0	4 / 2	2025-01-22
0.15.1	4 / 2	2024-12-11
0.15.0	4 / 2	2024-11-22
0.14.0	4 / 2	2024-11-02
0.13.1	4 / 2	2024-10-30
0.13.0	4 / 2	2024-09-23
0.12.0	4 / 2	2024-09-05
0.11.4	3 / 2	2024-08-28
0.11.3	3 / 2	2024-08-28
0.11.2	3 / 2	2024-08-28
0.11.1	3 / 2	2024-08-28
0.11.0	3 / 2	2024-08-28
0.10.5	3 / 2	2024-08-22
0.10.4	3 / 2	2024-08-22
0.10.3	3 / 2	2024-08-21
0.10.2	3 / 2	2024-07-29
0.10.1	3 / 2	2024-07-18
0.10.0	3 / 2	2024-07-16
0.9.0	3 / 2	2024-06-28
0.0.5	2 / 2	2023-04-18
0.0.4	2 / 2	2023-04-18
0.0.3	2 / 2	2023-03-24
0.0.1	2 / 2	2023-02-20

v0.18.2

2 findings

HIGH Bundled binary files (5) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.debug.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.1

2 findings

HIGH Bundled binary files (5) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.debug.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.18.0

2 findings

HIGH Bundled binary files (5) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.debug.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.17.0

2 findings

HIGH Bundled binary files (5) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.debug.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.16.0

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.1

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.1

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.0

2 findings

HIGH Bundled binary files (4) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding_weval.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.4

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.3

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.2

2 findings

HIGH Bundled binary files (2) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.1

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.11.0

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.5

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.4

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.3

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.2

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.1

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.10.0

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.9.0

2 findings

HIGH Bundled binary files (3) npm-metadata

Package contains compiled binaries that could be backdoors: • lib/spidermonkey-embedding-splicer.core.wasm • lib/spidermonkey-embedding-splicer.core2.wasm • lib/starlingmonkey_embedding.wasm

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.