← Home

@rspack-debug/browser

npm Repository Homepage

Rspack for running in the browser. This is still in early stage and may not follow the semver.

29
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

hardfist3stormslowly

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff encoded-string-file:dist/index.mjs AI (source-diff): Long strings are JSON-serialized crypto algorithm metadata from bundled browserify-sign; not obfuscation. ai
source-diff encoded-string-file:dist/index.js AI (source-diff): Long strings are plaintext JSON with crypto algorithm OIDs (node-forge/similar); not obfuscated payloads. ai
dependencies unvetted-dep:@types/watchpack AI (dependencies): @types/watchpack is a standard TypeScript type definition package; no security risk. ai
phantom-deps phantom-dep:@types/watchpack AI (phantom-deps): @types/watchpack is a type-only dependency used at build time; not directly imported at runtime by design. ai
phantom-deps phantom-dep:@emnapi/core AI (phantom-deps): @emnapi/core is a WASM runtime dep referenced in config; not directly imported in JS source by design. ai
bogus-package bogus-package AI (bogus-package): Cosmetic signals only; package is a legitimate rspack sub-package with SLSA provenance and a known upstream repo. ai

Versions (showing 29 of 29)

Version Deps Published
2.1.5 7 / 0
2.1.4 7 / 0
2.1.3 7 / 0
2.1.2 7 / 0
2.1.1 7 / 0
2.1.0 7 / 0
2.0.8 7 / 0
2.0.7 7 / 0
2.0.6 7 / 0
2.0.5 7 / 0
2.0.4 7 / 0
2.0.3 7 / 0
2.0.2 7 / 0
2.0.1 8 / 0
2.0.0 8 / 0
1.7.9 6 / 0
1.7.8 6 / 0
1.7.6 6 / 0
1.7.5 6 / 0
1.7.4 6 / 0
1.7.3 6 / 0
1.7.2 6 / 0
1.7.1 6 / 0
1.7.0 6 / 0
1.6.7 6 / 0
1.6.6 6 / 0
1.6.5 6 / 0
1.6.4 6 / 0
1.6.2 6 / 0

v2.1.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.1

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.0

2 findings
HIGH Long encoded string in modified file: dist/index.js source-diff

Modified file contains 9 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.