@redsift/rollup-bundler

## Installation

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): Fires on require(path.join(cwd,'package.json')) — reading target project metadata, not arbitrary module loading. Stable pattern for this bundler CLI.	ai	2026/05/10
phantom-deps	phantom-dep:eslint	AI (phantom-deps): ESLint loaded by convention in bundler config; not a direct import but a peer/plugin dependency.	ai	2026/05/10
phantom-deps	phantom-dep:@babel/core	AI (phantom-deps): Framework-scoped Babel package loaded by convention; expected for a rollup+babel bundler.	ai	2026/05/10
phantom-deps	phantom-dep:babel-eslint	AI (phantom-deps): ESLint parser loaded by config convention; stable false positive for this package.	ai	2026/05/10
phantom-deps	phantom-dep:@babel/helpers	AI (phantom-deps): Babel helper package loaded by convention; stable false positive for this bundler.	ai	2026/05/10
phantom-deps	phantom-dep:@babel/preset-env	AI (phantom-deps): Babel preset loaded by convention via babelrc config; stable false positive.	ai	2026/05/10
phantom-deps	phantom-dep:@babel/plugin-external-helpers	AI (phantom-deps): Babel plugin loaded by convention; stable false positive for this bundler.	ai	2026/05/10
phantom-deps	phantom-dep:@babel/plugin-transform-runtime	AI (phantom-deps): Babel plugin loaded by convention; stable false positive for this bundler.	ai	2026/05/10
phantom-deps	phantom-dep:@babel/plugin-proposal-class-properties	AI (phantom-deps): Babel plugin loaded by convention; stable false positive for this bundler.	ai	2026/05/10

Version	Deps	Published
2.0.5	23 / 0	2023-08-16