@lynx-js/web-rsbuild-server-middleware-canary
a dev server middleware for rsbuild to serve Lynx Web Platform shell project
27
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
colinaaa
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Canary placeholder release pattern for @lynx-js org; 0.0.0 is intentional, not malicious. | ai | |
| source-diff | obfuscated-file:www/static/js/async/540.js | AI (source-diff): Webpack-bundled build artifact with identifiable Lynx SDK internals; minification is expected for this package. | ai | |
| source-diff | net-exec-file:www/static/js/async/540.js | AI (source-diff): Network+eval pattern is part of the Lynx web runtime bundle, not dropper malware; consistent with package purpose. | ai | |
| source-diff | net-exec-file:www/static/js/async/web-core-worker-runtime.js | AI (source-diff): Network+eval pattern is from the webpack runtime loader, not dropper malware; consistent with this package's purpose. | ai | |
| source-diff | obfuscated-file:www/static/js/async/web-core-worker-runtime.js | AI (source-diff): Minified webpack bundle for Lynx web runtime; expected artifact for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Canary middleware package; thin README and no keywords are cosmetic, not spam indicators. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval in webpack-bundled lynx-core runtime; expected pattern for this package. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Fires in bundled wasm-bindgen glue code; stable false positive for this package. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 0.22.1 | 0 / 6 | |
| 0.22.0 | 0 / 6 | |
| 0.21.1 | 0 / 5 | |
| 0.21.0 | 0 / 5 | |
| 0.20.4 | 0 / 5 | |
| 0.20.3 | 0 / 5 | |
| 0.20.2 | 0 / 5 | |
| 0.20.1 | 0 / 5 | |
| 0.20.0 | 0 / 5 | |
| 0.19.9 | 0 / 5 | |
| 0.19.8 | 0 / 5 | |
| 0.19.7 | 0 / 5 | |
| 0.19.6 | 0 / 5 | |
| 0.19.5 | 0 / 5 | |
| 0.19.4 | 0 / 5 | |
| 0.19.3 | 0 / 5 | |
| 0.19.2 | 0 / 5 | |
| 0.19.1 | 0 / 5 | |
| 0.19.0 | 0 / 5 | |
| 0.18.4 | 0 / 5 | |
| 0.18.3 | 0 / 5 | |
| 0.18.2 | 0 / 5 | |
| 0.18.1 | 0 / 5 | |
| 0.18.0 | 0 / 5 | |
| 0.17.2 | 0 / 5 | |
| 0.17.1 | 0 / 5 | |
| 0.0.0 | 0 / 0 |
v0.22.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.22.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.