@rolldown/binding-wasm32-wasi
Fast JavaScript/TypeScript bundler in Rust with Rollup-compatible API.
25
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
broooooklynyyx990803rolldownbotsapphi-red
Keywords
bundleresbuildparcelrolldownrollupwebpack
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Shipping the compiled wasm module is this package's entire purpose; stable across versions. | ai | |
| phantom-deps | phantom-dep:@emnapi/core | AI (phantom-deps): emnapi runtime glue used by napi-rs wasm runtime, not directly imported. | ai | |
| phantom-deps | phantom-dep:@emnapi/runtime | AI (phantom-deps): emnapi runtime glue used by napi-rs wasm runtime, not directly imported. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): The fetch() call loads the .wasm binary in the browser-specific binding file — this is the standard WASM instantiation pattern, not telemetry or exfiltration. Stable false positive for this package. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 1.1.5 | 3 / 0 | |
| 1.1.4 | 3 / 0 | |
| 1.1.3 | 3 / 0 | |
| 1.1.2 | 3 / 0 | |
| 1.1.1 | 3 / 0 | |
| 1.1.0 | 3 / 0 | |
| 1.0.3 | 3 / 0 | |
| 1.0.2 | 3 / 0 | |
| 1.0.1 | 3 / 0 | |
| 1.0.0 | 3 / 0 | |
| 0.15.1 | 1 / 0 | |
| 0.15.0 | 1 / 0 | |
| 0.14.0 | 1 / 0 | |
| 0.13.2 | 1 / 0 | |
| 0.13.1 | 1 / 0 | |
| 0.13.0 | 1 / 0 | |
| 0.12.2 | 1 / 0 | |
| 0.12.1 | 1 / 0 | |
| 0.12.0 | 1 / 0 | |
| 0.11.1 | 1 / 0 | |
| 0.11.0 | 1 / 0 | |
| 0.10.5 | 1 / 0 | |
| 0.10.4 | 1 / 0 | |
| 0.10.3 | 1 / 0 | |
| 0.10.2 | 1 / 0 |
v1.1.5
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.4
2 findings
HIGH
Bundled binary files (1)
npm-metadata
Package contains compiled binaries that could be backdoors: • rolldown-binding.wasm32-wasi.wasm
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.