@rue-js/runtime
@rue-js/runtime
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher changed to GitHub Actions with SLSA provenance attestation; indicates legitimate CI/CD automation, not account compromise. | ai | |
| source-diff | encoded-string-file:dist/runtime.esm-browser.prod.js | AI (source-diff): Same WASM binary embedded as base64; minified wasm-bindgen glue, not a malicious payload. | ai | |
| source-diff | encoded-string-file:dist/runtime.global.js | AI (source-diff): Base64 WASM binary (AGFzbQ prefix); consistent with wasmrue_* exports in this package. | ai | |
| source-diff | encoded-string-file:dist/runtime.global.prod.js | AI (source-diff): Same WASM binary in minified global build; wasm-bindgen pattern confirmed. | ai | |
| source-diff | encoded-string-file:dist/runtime.esm-browser.js | AI (source-diff): Base64 WASM binary (AGFzbQ prefix); wasm-bindgen glue pattern is consistent throughout the file. | ai | |
| phantom-deps | phantom-dep:csstype | AI (phantom-deps): csstype is a type-only dep commonly used in Vue-ecosystem packages without direct imports. | ai | |
| phantom-deps | phantom-dep:@rue-js/rue | AI (phantom-deps): Same-org dep; likely re-exported rather than directly imported. | ai | |
| phantom-deps | phantom-dep:@rue-js/shared | AI (phantom-deps): Same-org dep; likely re-exported rather than directly imported. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by inlining a WASM binary as base64 in browser builds. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.4.2 | 4 / 1 | |
| 0.4.1 | 4 / 1 | |
| 0.3.10 | 4 / 1 | |
| 0.1.1 | 4 / 1 | |
| 0.0.39 | 4 / 1 | |
| 0.0.33 | 4 / 1 | |
| 0.0.32 | 4 / 1 | |
| 0.0.31 | 4 / 1 | |
| 0.0.30 | 4 / 1 | |
| 0.0.29 | 4 / 1 | |
| 0.0.28 | 4 / 1 | |
| 0.0.27 | 4 / 1 | |
| 0.0.25 | 4 / 1 | |
| 0.0.21 | 4 / 1 |
v0.4.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.4.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.3.10
6 findingsThis version was published by a different npm account than previous versions on 2026-05-24. This could indicate a legitimate maintainer transition or an account compromise.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.1
5 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.39
5 findingsModified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Modified file contains 1 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.33
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.