← Home

@tramvai/plugin-webpack-builder

npm
76
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

super_olegmeskilltinkoffbank

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:http-proxy AI (dependencies): http-proxy is a well-established npm package; its use in a webpack dev-server plugin is expected and benign. ai
semgrep semgrep:env-spread AI (semgrep): Spreading process.env into dev-server worker config is standard; not exfiltration. ai
semgrep semgrep:eval-usage AI (semgrep): eval() is in an integration test file evaluating controlled boolean expressions, not production code. ai
dependencies unvetted-dep:svgo AI (dependencies): svgo is a well-known SVG optimizer; stable legitimate dep for a webpack builder. ai
dependencies unvetted-dep:@tinkoff/is-modern-lib AI (dependencies): First-party @tinkoff dep consistent with tramvai ecosystem; no malware signal. ai
dependencies unvetted-dep:@rsdoctor/webpack-plugin AI (dependencies): rsdoctor is a known webpack analysis tool; legitimate build tooling dep. ai
semgrep semgrep:dynamic-require AI (semgrep): Plugin-loader pattern resolving webpack plugins by string name; expected behavior for this builder package. ai
phantom-deps phantom-dep:svgo AI (phantom-deps): svgo is a declared runtime dep used via config/loaders, not direct import; stable false positive. ai
bogus-package bogus-package AI (bogus-package): Monorepo-published internal framework package; missing metadata is typical for this pattern. ai
phantom-deps phantom-dep:lightningcss-loader AI (phantom-deps): lightningcss-loader used via webpack config string references, not direct import; stable false positive. ai
phantom-deps phantom-dep:file-loader AI (phantom-deps): file-loader referenced via webpack config, not direct import; stable false positive. ai
phantom-deps phantom-dep:@svgr/webpack AI (phantom-deps): @svgr/webpack referenced via webpack config, not direct import; stable false positive. ai

Versions (showing 76 of 76)

Version Deps Published
7.33.2 34 / 4
7.33.1 34 / 4
7.32.0 34 / 4
7.31.1 34 / 4
7.30.1 34 / 4
7.30.0 34 / 4
7.29.0 34 / 4
7.28.1 34 / 4
7.28.0 34 / 4
7.27.9 34 / 4
7.27.8 34 / 4
7.27.7 34 / 4
7.27.6 34 / 4
7.27.4 34 / 4
7.27.3 34 / 4
7.27.0 34 / 4
7.26.9 34 / 4
7.26.8 34 / 4
7.21.1 34 / 7
7.21.0 34 / 7
7.20.2 34 / 7
7.20.1 34 / 7
7.19.1 34 / 7
7.18.0 34 / 7
7.17.6 34 / 7
7.17.5 34 / 7
7.17.2 34 / 7
7.17.1 34 / 7
7.16.1 34 / 7
7.16.0 34 / 7
7.4.3 41 / 9
7.2.0 41 / 9
6.82.22 34 / 4
6.82.21 34 / 4
6.82.19 34 / 4
6.82.18 34 / 4
6.82.13 34 / 4
6.82.12 34 / 4
6.82.11 34 / 4
6.82.10 34 / 4
6.82.9 34 / 4
6.82.8 34 / 4
6.82.5 34 / 4
6.82.4 34 / 4
6.82.3 34 / 4
6.82.1 34 / 4
6.82.0 34 / 4
6.81.18 34 / 4
6.81.13 34 / 4
6.81.12 34 / 4
6.81.11 34 / 4
6.80.26 34 / 7
6.80.25 34 / 7
6.80.23 34 / 7
6.80.20 34 / 7
6.80.19 34 / 7
6.80.16 34 / 7
6.80.14 34 / 7
6.80.13 34 / 7
6.80.11 34 / 7
6.80.10 34 / 7
6.80.8 34 / 7
6.80.7 34 / 7
6.80.6 34 / 7
6.79.11 41 / 9
6.79.0 41 / 9
6.68.0 38 / 9
6.67.1 38 / 9
6.67.0 38 / 9
6.66.1 38 / 9
6.65.0 38 / 9
6.64.1 38 / 9
6.63.1 38 / 9
6.63.0 38 / 9
6.62.0 38 / 9
6.59.0 38 / 9

v7.33.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.33.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.32.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.31.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.30.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.30.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.29.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.28.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.28.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.27.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.27.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v7.27.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.9

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.82.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.67.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.67.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.66.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.65.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.64.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.63.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.63.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.62.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.59.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.