← Home

@parcel/utils

npm Repository Homepage

Blazing fast, zero configuration web application bundler

50
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

devongovett

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:child-process-import AI (semgrep): child_process used in openInBrowser.js to open URLs in the system browser — legitimate build tool functionality, explicitly excluded from browser builds in package.json. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require() in a bundler's config loader is expected behavior — Parcel loads user config files at runtime by design. Stable false positive for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decode is used to parse inline source map data URLs (standard format). Legitimate tooling use case, not a payload obfuscation risk. ai

Versions (showing 50 of 50)

Show 19 prereleases
Version Deps Published
2.16.4 8 / 16
2.16.3 8 / 16
2.16.2 8 / 16
2.16.1 8 / 16
2.16.0 8 / 16
2.15.4 8 / 16
2.15.3 8 / 16
2.15.2 8 / 16
2.15.1 8 / 16
2.15.0 8 / 16
2.14.4 8 / 16
2.14.3 8 / 16
2.14.2 8 / 16
2.14.1 8 / 16
2.14.0 8 / 16
2.13.3 8 / 16
2.13.2 8 / 16
2.13.1 8 / 16
2.13.0 8 / 16
2.12.0 8 / 17
2.11.0 8 / 17
2.10.3 8 / 17
2.10.2 8 / 16
2.10.1 8 / 16
2.10.0 8 / 16
2.9.3 8 / 16
2.9.2 8 / 16
2.9.1 8 / 16
2.9.0 8 / 16
2.8.3 7 / 15
2.8.2 7 / 15
2.8.1 7 / 15
2.8.0 7 / 15
2.7.0 7 / 15
2.6.2 7 / 15
2.6.1 7 / 15
2.6.0 7 / 15
2.5.0 7 / 15
2.4.1 7 / 16
2.4.0 7 / 16
2.3.2 7 / 16
2.3.1 7 / 16
2.3.0 7 / 16
2.2.1 21 / 2
2.2.0 21 / 2
2.1.1 21 / 2
2.1.0 21 / 2
2.0.1 21 / 2
2.0.0 21 / 2
1.11.0 0 / 0