@rolldown/binding-wasm32-wasi
Fast JavaScript/TypeScript bundler in Rust with Rollup-compatible API.
58
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
broooooklynyyx990803rolldownbotsapphi-red
Keywords
bundleresbuildparcelrolldownrollupwebpack
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Shipping the compiled wasm module is this package's entire purpose; stable across versions. | ai | |
| phantom-deps | phantom-dep:@emnapi/core | AI (phantom-deps): emnapi runtime glue used by napi-rs wasm runtime, not directly imported. | ai | |
| phantom-deps | phantom-dep:@emnapi/runtime | AI (phantom-deps): emnapi runtime glue used by napi-rs wasm runtime, not directly imported. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): The fetch() call loads the .wasm binary in the browser-specific binding file — this is the standard WASM instantiation pattern, not telemetry or exfiltration. Stable false positive for this package. | ai |
Versions (showing 58 of 58)
| Version | Deps | Published |
|---|---|---|
| 1.1.5 | 3 / 0 | |
| 1.1.4 | 3 / 0 | |
| 1.1.3 | 3 / 0 | |
| 1.1.2 | 3 / 0 | |
| 1.1.1 | 3 / 0 | |
| 1.1.0 | 3 / 0 | |
| 1.0.3 | 3 / 0 | |
| 1.0.2 | 3 / 0 | |
| 1.0.1 | 3 / 0 | |
| 1.0.0 | 3 / 0 | |
| 0.15.1 | 1 / 0 | |
| 0.15.0 | 1 / 0 | |
| 0.14.0 | 1 / 0 | |
| 0.13.2 | 1 / 0 | |
| 0.13.1 | 1 / 0 | |
| 0.13.0 | 1 / 0 | |
| 0.12.2 | 1 / 0 | |
| 0.12.1 | 1 / 0 | |
| 0.12.0 | 1 / 0 | |
| 0.11.1 | 1 / 0 | |
| 0.11.0 | 1 / 0 | |
| 0.10.5 | 1 / 0 | |
| 0.10.4 | 1 / 0 | |
| 0.10.3 | 1 / 0 | |
| 0.10.2 | 1 / 0 | |
| 1.0.0-rc.9 | 1 / 0 | |
| 1.0.0-rc.8 | 1 / 0 | |
| 1.0.0-rc.7 | 1 / 0 | |
| 1.0.0-rc.6 | 1 / 0 | |
| 1.0.0-rc.5 | 1 / 0 | |
| 1.0.0-rc.4 | 1 / 0 | |
| 1.0.0-rc.3 | 1 / 0 | |
| 1.0.0-rc.2 | 1 / 0 | |
| 1.0.0-rc.17 | 3 / 0 | |
| 1.0.0-rc.16 | 3 / 0 | |
| 1.0.0-rc.15 | 3 / 0 | |
| 1.0.0-rc.14 | 3 / 0 | |
| 1.0.0-rc.13 | 3 / 0 | |
| 1.0.0-rc.12 | 1 / 0 | |
| 1.0.0-rc.11 | 1 / 0 | |
| 1.0.0-rc.10 | 1 / 0 | |
| 1.0.0-rc.1 | 1 / 0 | |
| 1.0.0-beta.60 | 1 / 0 | |
| 1.0.0-beta.59 | 1 / 0 | |
| 1.0.0-beta.58 | 1 / 0 | |
| 1.0.0-beta.57 | 1 / 0 | |
| 1.0.0-beta.56 | 1 / 0 | |
| 1.0.0-beta.55 | 1 / 0 | |
| 1.0.0-beta.54 | 1 / 0 | |
| 1.0.0-beta.53 | 1 / 0 | |
| 1.0.0-beta.52 | 1 / 0 | |
| 1.0.0-beta.51 | 1 / 0 | |
| 1.0.0-beta.50 | 1 / 0 | |
| 1.0.0-beta.49 | 1 / 0 | |
| 1.0.0-beta.48 | 1 / 0 | |
| 1.0.0-beta.47 | 1 / 0 | |
| 1.0.0-beta.46 | 1 / 0 | |
| 1.0.0-beta.45 | 1 / 0 |
v1.1.5
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.1.4
2 findings
HIGH
Bundled binary files (1)
npm-metadata
Package contains compiled binaries that could be backdoors: • rolldown-binding.wasm32-wasi.wasm
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.