← Home

@rspack/cli

npm Repository Homepage
14
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

hardfist3chenjiahan

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff source-size-tripled AI (source-diff): Size increase from inlining jiti+babel as compiled dependencies instead of runtime deps. ai
source-diff obfuscated-file:compiled/jiti/dist/babel.cjs AI (source-diff): Webpack-bundled @babel/core for jiti; standard prebundled dependency pattern for this CLI package. ai
source-diff obfuscated-file:compiled/jiti/dist/jiti.cjs AI (source-diff): Webpack-bundled jiti distribution; standard prebundled dependency pattern for this CLI package. ai
source-diff net-exec-file:compiled/jiti/dist/babel.cjs AI (source-diff): Babel core bundle naturally contains dynamic require + module resolution; not malicious network/exec. ai
provenance publisher-changed AI (provenance): Rspack migrated to GitHub Actions CI publishing with SLSA provenance attestation — this is an expected, legitimate automation transition for a mature open-source project. ai
publish-pattern new-deps-added AI (publish-pattern): pirates is a well-known, legitimate require-hook package replacing interpret/rechoir; benign dependency swap consistent with the package's purpose. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @rspack/cli is the official CLI for the Rspack bundler, not a typosquat of 'joi'. The levenshtein match is spurious for this scoped package. ai
bogus-package bogus-package AI (bogus-package): hardfist and chenjiahan are known Rspack/ByteDance engineers; spam flag is a false positive. Package is a legitimate, established CLI tool with 1191 versions and SLSA provenance. ai

Versions (showing 14 of 114)

Version Deps Published
1.0.4 9 / 12
1.0.3 9 / 12
1.0.2 9 / 12
1.0.1 9 / 12
1.0.0 9 / 12
0.7.5 9 / 8
0.7.4 9 / 8
0.7.3 9 / 8
0.7.2 9 / 8
0.7.1 9 / 8
0.7.0 9 / 8
0.6.5 9 / 8
0.6.4 9 / 8
0.6.3 9 / 8

v0.7.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.6.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.