← Home

@lynx-js/rspeedy

npm Repository

A webpack/rspack-based frontend toolchain for Lynx

51
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

colinaaa

Keywords

webpackrspackLynxReactLynx

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/1~validate.js AI (source-diff): Same webpack bundle pattern as dist/0~validate.js; false positive for this package. ai
source-diff obfuscated-file:dist/0~validate.js AI (source-diff): Webpack-bundled output with readable identifiers; not true obfuscation. Stable pattern for this build toolchain. ai
publish-pattern dormant-publish AI (publish-pattern): Dormancy explained by monorepo release cadence; SLSA provenance confirms legitimate CI publish. ai
source-diff obfuscated-file:dist/1~src_config_validate_ts.js AI (source-diff): Same rspack bundle pattern; readable code, long lines from bundled dependencies. ai
source-diff obfuscated-file:dist/0~src_config_validate_ts.js AI (source-diff): Rspack bundle chunk with long lines from bundled node_modules (typia); not obfuscated, just minified build output. ai
maintainer-change maintainer-removed AI (maintainer-change): Consistent with migration to GitHub Actions CI publishing; SLSA attestation confirms integrity. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA provenance; legitimate supply chain improvement. ai
publish-pattern new-deps-added AI (publish-pattern): New dep is a first-party @lynx-js scoped package; consistent with the package's own ecosystem. ai
dependencies unvetted-dep:@rsbuild/core AI (dependencies): Core rsbuild dependency; expected for this build toolchain package. ai
dependencies unvetted-dep:@lynx-js/web-rsbuild-server-middleware AI (dependencies): First-party @lynx-js scoped package; expected sibling dependency. ai
dependencies unvetted-dep:@lynx-js/chunk-loading-webpack-plugin AI (dependencies): First-party @lynx-js scoped package; expected sibling dependency. ai
dependencies unvetted-dep:@lynx-js/cache-events-webpack-plugin AI (dependencies): First-party @lynx-js scoped package; expected sibling dependency. ai
dependencies unvetted-dep:@lynx-js/webpack-dev-transport AI (dependencies): First-party @lynx-js scoped package; expected sibling dependency. ai
dependencies unvetted-dep:@lynx-js/websocket AI (dependencies): First-party @lynx-js scoped package; expected sibling dependency. ai
dependencies unvetted-dep:@rsdoctor/rspack-plugin AI (dependencies): rsdoctor diagnostics plugin; expected for build toolchain. ai
dependencies unvetted-dep:@rsbuild/plugin-css-minimizer AI (dependencies): Standard rsbuild plugin; expected dependency for this toolchain. ai

Versions (showing 51 of 51)

Version Deps Published
0.16.0 9 / 20
0.15.2 9 / 20
0.15.1 9 / 20
0.15.0 9 / 20
0.14.5 8 / 20
0.14.4 8 / 20
0.14.3 8 / 20
0.14.2 8 / 19
0.14.1 8 / 19
0.14.0 8 / 19
0.13.6 8 / 19
0.13.5 8 / 19
0.13.4 8 / 19
0.13.3 8 / 19
0.13.2 8 / 19
0.13.1 8 / 19
0.13.0 8 / 19
0.12.5 8 / 19
0.12.4 8 / 19
0.12.3 8 / 19
0.12.2 8 / 19
0.12.1 8 / 19
0.12.0 8 / 19
0.11.9 8 / 19
0.11.8 8 / 19
0.11.2 7 / 19
0.11.1 7 / 19
0.11.0 7 / 19
0.10.8 7 / 18
0.10.7 6 / 18
0.10.6 6 / 18
0.10.5 6 / 20
0.10.4 6 / 20
0.10.3 6 / 20
0.10.2 6 / 20
0.10.1 6 / 20
0.10.0 6 / 20
0.9.11 6 / 20
0.9.10 6 / 20
0.9.9 6 / 20
0.9.8 6 / 20
0.9.7 6 / 20
0.9.6 6 / 20
0.9.5 6 / 20
0.9.4 6 / 20
0.8.7 16 / 7
0.8.6 16 / 7
0.8.5 16 / 7
0.8.4 16 / 7
0.8.3 16 / 7
0.8.2 17 / 8

v0.16.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.1

3 findings
HIGH New obfuscated file: dist/0~validate.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/1~validate.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.0

3 findings
HIGH New obfuscated file: dist/0~validate.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/1~validate.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.13.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.12.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.11.9

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: lynxdev-admin → GitHub Actions (on 2025-11-09) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-11-09. This could indicate a legitimate maintainer transition or an account compromise.

v0.11.8

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: lynxdev-admin → GitHub Actions (on 2025-11-03) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-11-03. This could indicate a legitimate maintainer transition or an account compromise.

v0.8.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.8.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.