@rolldown/browser
Fast JavaScript/TypeScript bundler in Rust with Rollup-compatible API.
3
Versions
MIT
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
broooooklynyyx990803rolldownbotsapphi-red
Keywords
bundleresbuildparcelrolldownrollupwebpack
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/shared/prompt-DewH0PjV.mjs | AI (source-diff): Minified build artifact from consola dependency; readable source comments confirm legitimate bundler output. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-BodFrzFa.mjs | AI (source-diff): Minified rolldown internal build artifact; source structure and imports confirm legitimate bundler output. | ai | |
| source-diff | obfuscated-file:dist/shared/binding-Ba2kzvIy.d.mts | AI (source-diff): TypeScript declaration file with long lines due to large export lists; not obfuscated, just a wide type declaration. | ai | |
| install-scripts | install-script:preinstall | AI (install-scripts): npx only-allow pnpm is a standard monorepo package-manager guard; not a security risk. | ai | |
| phantom-deps | phantom-dep:@emnapi/core | AI (phantom-deps): Declared runtime dep for WASM/emnapi bindings; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@emnapi/runtime | AI (phantom-deps): Declared runtime dep for WASM/emnapi bindings; stable false positive for this package. | ai |