@vercel/webpack-asset-relocator-loader
Asset relocation loader used in ncc for performing Node.js builds while emitting and relocating any asset references.
25
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
matheusschriswdmrnick.traceymatt.strakavercel-release-botquietshuijjkzeit-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:resolve-from | AI (phantom-deps): resolve-from is a declared runtime dep; phantom-dep false positive likely due to indirect usage or config-level reference in this build tool. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from styfle to zeit-bot reflects Vercel's organizational transition; zeit-bot is the official Vercel automation account with a strong track record across hundreds of packages. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval("require.resolve(...)") is a documented bundler technique to prevent static capture of require calls; consistent with this package's asset relocation purpose across all versions. | ai | |
| dependencies | unvetted-dep:node-gyp-build | AI (dependencies): node-gyp-build is a well-established native addon loader; its use is appropriate for a webpack asset relocator that handles native binaries. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removals alongside additions in a large org like Vercel reflect normal team churn, not a takeover signal. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): 'resolve' is a well-established module resolution library; its addition is consistent with the build script change externalizing it (-e resolve flag in ncc build). | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Vercel is a large org; maintainer roster changes reflect normal team rotation. Published by vercel-release-bot with a strong track record across the Vercel ecosystem. | ai |
Versions (showing 25 of 25)
| Version | Deps | Published |
|---|---|---|
| 1.10.0 | 16 / 7 | |
| 1.9.1 | 1 / 22 | |
| 1.9.0 | 1 / 22 | |
| 1.8.0 | 1 / 22 | |
| 1.7.5 | 1 / 22 | |
| 1.7.4 | 1 / 23 | |
| 1.7.3 | 1 / 23 | |
| 1.7.2 | 0 / 24 | |
| 1.7.1 | 0 / 24 | |
| 1.7.0 | 0 / 24 | |
| 1.6.0 | 0 / 24 | |
| 1.5.0 | 0 / 24 | |
| 1.4.1 | 0 / 23 | |
| 1.4.0 | 0 / 23 | |
| 1.3.1 | 0 / 23 | |
| 1.3.0 | 0 / 23 | |
| 1.2.4 | 0 / 23 | |
| 1.2.3 | 0 / 26 | |
| 1.2.2 | 0 / 26 | |
| 1.2.1 | 0 / 26 | |
| 1.2.0 | 0 / 26 | |
| 1.1.1 | 0 / 26 | |
| 1.1.0 | 0 / 26 | |
| 1.0.0 | 0 / 26 | |
| 0.9.1 | 0 / 24 |