@rspack/browser
Rspack for running in the browser. This is still in early stage and may not follow the semver.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:dist/index.js | AI (source-diff): Network/exec pattern in a bundled rspack/webpack runtime is expected; no dropper behavior evident in sample. | ai | |
| source-diff | obfuscated-file:dist/index.js | AI (source-diff): dist/index.js is a bundled rspack build artifact; long lines are minified module registry code, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/index.mjs | AI (source-diff): Large bundled browser build artifact from official rspack monorepo; long lines are minified bundle, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/index.mjs | AI (source-diff): Network/exec pattern fires on bundled webpack runtime in a browser build; not a dropper. | ai | |
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Long strings are JSON-serialized crypto algorithm data from browserify-sign; not obfuscation. Pattern is stable for this bundled package. | ai | |
| dependencies | unvetted-dep:@types/watchpack | AI (dependencies): @types/watchpack is a standard DefinitelyTyped type definition package; no security risk. | ai | |
| phantom-deps | phantom-dep:@emnapi/core | AI (phantom-deps): Used as a WASM runtime dependency loaded by convention, not directly imported in source. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Legitimate rspack monorepo sub-package; sparse README is expected for a browser-specific build artifact. | ai | |
| phantom-deps | phantom-dep:@types/watchpack | AI (phantom-deps): Type-only package loaded by framework convention; phantom-dep false positive for @types/* packages. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 2.1.4 | 7 / 0 | |
| 2.1.3 | 7 / 0 | |
| 2.1.2 | 7 / 0 | |
| 2.1.1 | 7 / 0 | |
| 2.1.0 | 7 / 0 | |
| 2.0.8 | 7 / 0 | |
| 2.0.7 | 7 / 0 | |
| 2.0.6 | 7 / 0 | |
| 2.0.5 | 7 / 0 | |
| 2.0.4 | 7 / 0 | |
| 2.0.3 | 7 / 0 | |
| 2.0.2 | 7 / 0 | |
| 2.0.1 | 8 / 0 | |
| 2.0.0 | 8 / 0 | |
| 1.7.12 | 6 / 0 | |
| 1.7.11 | 6 / 0 | |
| 1.6.1 | 6 / 0 |
v2.1.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.1.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.