@dimforge/rapier3d-compat

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

sebcrozet

Keywords

physicsdynamicsrigidreal-timejoints

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:rapier.cjs.js	AI (source-diff): wasm-bindgen glue in official rapier build; no real net-exec dropper.	ai	2026/07/21
source-diff	net-exec-file:rapier_wasm3d.js	AI (source-diff): Standard wasm-bindgen generated glue.	ai	2026/07/21
source-diff	obfuscated-file:rapier.es.js	AI (source-diff): Minified bundle output, not obfuscation.	ai	2026/07/21
source-diff	net-exec-file:rapier.es.js	AI (source-diff): wasm-bindgen glue in official rapier build; benign.	ai	2026/07/21
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get in wasm-bindgen host import table; benign.	ai	2026/07/21
npm-metadata	bundled-binaries	AI (npm-metadata): WASM is the compiled Rust physics engine, the package's core deliverable.	ai	2026/07/08
bogus-package	bogus-package	AI (bogus-package): No-deps and link-heavy README are normal for this self-contained WASM binding.	ai	2026/07/08
source-diff	net-exec-file:rapier.mjs	AI (source-diff): ESM variant of same wasm-bindgen glue; stable false positive.	ai	2026/05/20
source-diff	obfuscated-file:rapier.cjs	AI (source-diff): wasm-bindgen minified output; expected for this WASM physics engine package.	ai	2026/05/20
source-diff	obfuscated-file:rapier.mjs	AI (source-diff): ESM variant of same wasm-bindgen output; stable pattern.	ai	2026/05/20
source-diff	net-exec-file:rapier.cjs	AI (source-diff): wasm-bindgen glue code pattern, not actual network+exec malware.	ai	2026/05/20
source-diff	encoded-string-file:rapier.es.js	AI (source-diff): Base64-inlined WASM binary is the documented distribution format for this -compat package.	ai	2026/05/18
source-diff	encoded-string-file:rapier.cjs.js	AI (source-diff): Base64-inlined WASM binary is the documented distribution format for this -compat package.	ai	2026/05/18
semgrep	semgrep:new-function-constructor	AI (semgrep): This is standard wasm-bindgen generated glue code. The new Function() call is a required JS interop shim for the WASM runtime, not arbitrary code execution. Stable pattern across all versions of this package.	ai	2026/04/25
provenance	no-provenance	AI (provenance): Established Dimforge package with 117 versions; lack of Sigstore provenance is common and not a risk indicator for this well-known physics engine binding.	ai	2026/04/25

Versions (showing 41 of 41)

Version	Deps	Published
0.19.3	0 / 0	2025-11-05
0.19.2	0 / 0	2025-10-17
0.19.1	0 / 0	2025-10-03
0.19.0	0 / 0	2025-09-05
0.18.2	0 / 0	2025-08-13
0.18.1	0 / 0	2025-08-08
0.18.0	0 / 0	2025-07-24
0.17.3	0 / 0	2025-05-30
0.17.2	0 / 0	2025-05-30
0.17.1	0 / 0	2025-05-23
0.17.0	0 / 0	2025-05-16
0.16.2	0 / 0	2025-05-05
0.16.1	0 / 0	2025-05-02
0.16.0	0 / 0	2025-04-24
0.15.1	0 / 0	2025-04-10
0.15.0	0 / 0	2025-03-06
0.14.0	0 / 0	2024-07-20
0.13.1	0 / 0	2024-05-08
0.13.0	0 / 0	2024-05-05
0.12.0	0 / 0	2024-01-28
0.11.2	0 / 0	2023-03-04
0.11.1	0 / 0	2023-01-16
0.10.0	0 / 0	2022-11-09
0.9.0	0 / 0	2022-07-10
0.8.1	0 / 0	2022-06-04
0.8.0	0 / 0	2022-05-31
0.7.6	0 / 0	2021-09-12
0.7.5	0 / 0	2021-09-05
0.7.4	0 / 0	2021-09-05
0.7.3	0 / 0	2021-08-31
0.7.2	0 / 0	2021-08-30
0.7.1	0 / 0	2021-08-08
0.7.0	0 / 0	2021-07-12
0.6.0	0 / 0	2021-06-03
0.5.3	0 / 0	2021-04-06
0.5.1	0 / 0	2021-04-02
0.4.1	0 / 0	2021-03-02
0.4.0	0 / 0	2021-03-01
0.3.1	0 / 0	2021-02-08
0.3.0	0 / 0	2021-01-29
0.2.13	0 / 0	2021-01-07

v0.16.0

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • rapier_wasm3d_bg.wasm

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.1

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • rapier_wasm3d_bg.wasm

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.15.0

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • rapier_wasm3d_bg.wasm

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.14.0

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • rapier_wasm3d_bg.wasm

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.1

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • rapier_wasm3d_bg.wasm

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.13.0

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • rapier_wasm3d_bg.wasm

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.12.0

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.2

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.1

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.10.0

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.9.0

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.1

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.8.0

2 findings

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.6

5 findings

HIGH New file with network + code execution: rapier.cjs.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: rapier.es.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: rapier_wasm3d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.5

5 findings

HIGH New file with network + code execution: rapier.cjs.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: rapier.es.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: rapier_wasm3d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.4

5 findings

HIGH New file with network + code execution: rapier.cjs.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: rapier.es.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: rapier_wasm3d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.3

5 findings

HIGH New file with network + code execution: rapier.cjs.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: rapier.es.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: rapier_wasm3d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.2

5 findings

HIGH New file with network + code execution: rapier.cjs.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: rapier.es.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: rapier_wasm3d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.1

5 findings

HIGH New file with network + code execution: rapier.cjs.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: rapier.es.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: rapier.es.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New file with network + code execution: rapier_wasm3d.js source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.6.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.