webpack-manifest-plugin
A Webpack Plugin for generating Asset Manifests
38
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
danethurbershellscape
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:mutexify | AI (dependencies): mutexify is a well-known, benign mutex utility; its use in a file-writing webpack plugin is appropriate and poses no meaningful risk. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): fs-extra is a widely-used, legitimate Node.js filesystem utility package; its addition is consistent with the plugin's manifest file-writing functionality. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from danethurber to mastilver occurred in 2017; mastilver is a known ecosystem contributor and legitimate maintainer of this package. Stable historical transition. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): mastilver is a well-known contributor to webpack-manifest-plugin; this is a legitimate maintainer addition from 2017, not a suspicious takeover. | ai | |
| provenance | missing-githead | AI (provenance): shellscape is an established publisher with strong track record; missing gitHead reflects a publish environment change, not a security concern for this package. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Long dormancy followed by a major version bump with modernized tooling (vitest, updated node engine) is consistent with legitimate maintenance by a trusted publisher with a clean track record. | ai | |
| provenance | no-provenance | AI (provenance): Established package from a trusted publisher with a clean track record; lack of provenance is common and not a risk signal here. | ai | |
| dependencies | unvetted-dep:tapable | AI (dependencies): tapable is a core webpack ecosystem package maintained by the webpack team; it is a standard and expected dependency for any webpack plugin. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 6.0.1 | 2 / 24 | |
| 6.0.0 | 2 / 24 | |
| 5.0.1 | 2 / 28 | |
| 5.0.0 | 2 / 28 | |
| 4.1.1 | 2 / 30 | |
| 4.1.0 | 2 / 30 | |
| 4.0.2 | 2 / 30 | |
| 4.0.1 | 2 / 30 | |
| 4.0.0 | 2 / 30 | |
| 3.2.0 | 2 / 21 | |
| 3.1.1 | 2 / 20 | |
| 3.1.0 | 2 / 20 | |
| 3.0.0 | 2 / 20 | |
| 2.2.0 | 4 / 11 | |
| 2.1.2 | 4 / 11 | |
| 2.1.1 | 4 / 11 | |
| 2.1.0 | 3 / 11 | |
| 2.0.4 | 3 / 11 | |
| 2.0.3 | 3 / 11 | |
| 2.0.2 | 3 / 9 | |
| 2.0.1 | 3 / 9 | |
| 2.0.0 | 3 / 9 | |
| 1.3.2 | 2 / 10 | |
| 1.3.1 | 2 / 10 | |
| 1.3.0 | 3 / 10 | |
| 1.2.1 | 2 / 10 | |
| 1.2.0 | 2 / 10 | |
| 1.1.2 | 2 / 6 | |
| 1.1.1 | 2 / 6 | |
| 1.1.0 | 2 / 6 | |
| 1.0.1 | 1 / 6 | |
| 1.0.0 | 1 / 6 | |
| 0.5.0 | 1 / 6 | |
| 0.4.0 | 1 / 6 | |
| 0.3.0 | 1 / 6 | |
| 0.2.0 | 1 / 6 | |
| 0.0.2 | 1 / 6 | |
| 0.0.1 | 1 / 6 |