@rollipop/rolldown
Fast JavaScript/TypeScript bundler in Rust with Rollup-compatible API.
13
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
ghlee
Keywords
bundleresbuildparcelrolldownrollupwebpack
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/shared/rolldown-build-DNVk6IXy.mjs | AI (source-diff): Long lines are minified bundler output from rolldown/rollup build pipeline, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-BQuFBSl3.mjs | AI (source-diff): Long lines are bundler output (rolldown bundles itself); sample shows normal readable JS, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-Df-vz0Zv.mjs | AI (source-diff): Standard bundler build output; long lines from minification, not obfuscation. Consistent with this package's build pattern. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-C1JLRyVO.mjs | AI (source-diff): Long lines are bundler output (rolldown bundles itself); readable identifiers confirm no obfuscation. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-EhkMDtj3.mjs | AI (source-diff): Minified bundler output with readable imports/logic; no obfuscation indicators. SLSA provenance confirms CI build origin. | ai | |
| source-diff | obfuscated-file:dist/shared/prompt-DYnaB1Nb.mjs | AI (source-diff): Bundled consola prompt library; minified dist output, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-DOmcVgQR.mjs | AI (source-diff): Bundled rolldown build logic; minified dist output consistent with bundler package. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-BRkOWCDB.mjs | AI (source-diff): Minified/bundled build output for a JS bundler package; not obfuscated malware. SLSA provenance confirms CI/CD origin. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-Dy4Qg7um.mjs | AI (source-diff): Minified bundler output with readable code; not obfuscated. Expected artifact for a bundler package. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-BKTuWCJv.mjs | AI (source-diff): Minified bundler build output with readable identifiers and SLSA provenance; not malicious obfuscation. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-BlO9UHnS.mjs | AI (source-diff): Minified build artifact from bundler pipeline; readable JS with named imports, not obfuscated. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/shared/rolldown-build-BZvmhVbS.mjs | AI (source-diff): Minified bundler output; readable imports and logic visible in sample, no obfuscation or payload. | ai |