@modern-js/rsbuild-plugin-esbuild
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires in compiled vendor bundle (esbuild-loader); expected pattern for bundled build tool dependencies. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires in compiled vendor bundle; not indicative of malicious payload in this build tool plugin context. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Fires in compiled vendor bundle; standard pattern in bundled dependencies for a build tool plugin. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Scoped monorepo package with valid homepage and GitHub repo; README signals are false positives for internal tooling packages. | ai | |
| phantom-deps | phantom-dep:@swc/helpers | AI (phantom-deps): @swc/helpers is a known implicit runtime dependency for SWC-compiled output; phantom-dep is a stable false positive here. | ai |
Versions (showing 51 of 73)
| Version | Deps | Published |
|---|---|---|
| 2.71.1 | 3 / 4 | |
| 2.71.0 | 3 / 4 | |
| 2.70.8 | 3 / 4 | |
| 2.70.7 | 3 / 4 | |
| 2.70.6 | 3 / 4 | |
| 2.70.5 | 3 / 4 | |
| 2.70.4 | 3 / 4 | |
| 2.70.3 | 3 / 4 | |
| 2.70.2 | 3 / 4 | |
| 2.70.1 | 3 / 4 | |
| 2.70.0 | 3 / 4 | |
| 2.69.7 | 3 / 4 | |
| 2.69.6 | 3 / 4 | |
| 2.69.5 | 3 / 4 | |
| 2.69.4 | 3 / 4 | |
| 2.69.3 | 3 / 4 | |
| 2.69.2 | 3 / 4 | |
| 2.69.1 | 3 / 4 | |
| 2.69.0 | 3 / 4 | |
| 2.68.20 | 3 / 4 | |
| 2.68.19 | 3 / 4 | |
| 2.68.18 | 3 / 4 | |
| 2.68.17 | 3 / 4 | |
| 2.68.16 | 3 / 4 | |
| 2.68.15 | 3 / 4 | |
| 2.68.14 | 3 / 4 | |
| 2.68.13 | 3 / 4 | |
| 2.68.12 | 3 / 4 | |
| 2.68.11 | 3 / 4 | |
| 2.68.10 | 3 / 4 | |
| 2.68.9 | 3 / 4 | |
| 2.68.8 | 3 / 4 | |
| 2.68.7 | 3 / 4 | |
| 2.68.6 | 3 / 4 | |
| 2.68.5 | 3 / 4 | |
| 2.68.4 | 3 / 4 | |
| 2.68.3 | 3 / 4 | |
| 2.68.2 | 3 / 4 | |
| 2.68.1 | 3 / 4 | |
| 2.68.0 | 3 / 4 | |
| 2.67.11 | 3 / 4 | |
| 2.67.10 | 3 / 4 | |
| 2.67.9 | 3 / 4 | |
| 2.67.8 | 3 / 4 | |
| 2.67.7 | 3 / 4 | |
| 2.67.6 | 3 / 4 | |
| 2.67.5 | 3 / 4 | |
| 2.63.4 | 3 / 4 | |
| 2.63.3 | 3 / 4 | |
| 2.63.2 | 3 / 4 | |
| 2.63.1 | 3 / 4 |
v2.71.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.63.4
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. Multiple high-profile registry compromises have exhibited exactly this pattern.
v2.63.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.63.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.63.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.