workbox-build
A module that integrates into your build process, helping you generate a manifest of local files that workbox-sw should precache.
51
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
gauntfacejeffposnickaddyosmaniphilipwaltontropicadriwestonrutertomayackhempeniusswissspidysnugug
Keywords
workboxworkboxjsservice workercachingfetch requestsofflinefile manifest
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Publisher change from gauntface to jeffposnick is a documented legitimate transition between Google Web DevRel team members on the Workbox project; stable for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance on npm; published by trusted Google Chrome team maintainer with long track record. | ai | |
| dependencies | unvetted-dep:fast-json-stable-stringify | AI (dependencies): fast-json-stable-stringify is a widely-used, stable utility with no known security issues; its use in a build tool is benign and expected. | ai | |
| phantom-deps | phantom-dep:workbox-recipes | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-routing | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-streams | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-expiration | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-precaching | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-strategies | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-range-requests | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-sw | AI (phantom-deps): workbox-sw is a sibling package bundled/processed by workbox-build at build time; referenced in config/template files, not directly imported. Expected architecture. | ai | |
| phantom-deps | phantom-dep:workbox-broadcast-update | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-google-analytics | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-cacheable-response | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-navigation-preload | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:@babel/core | AI (phantom-deps): Framework-scoped package loaded by convention through rollup-plugin-babel. Standard pattern for build tools. | ai | |
| phantom-deps | phantom-dep:@babel/runtime | AI (phantom-deps): Framework-scoped package loaded by convention through rollup-plugin-babel. Standard pattern for build tools. | ai | |
| phantom-deps | phantom-dep:workbox-background-sync | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-core | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| phantom-deps | phantom-dep:workbox-window | AI (phantom-deps): Sibling workbox package used as build input, not a direct JS import. Expected for this build tool. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require() loads package.json from known workbox modules in a build tool context; standard and safe pattern. | ai |
Versions (showing 51 of 56)
| Version | Deps | Published |
|---|---|---|
| 7.4.1 | 37 / 1 | |
| 7.4.0 | 37 / 1 | |
| 7.3.0 | 37 / 1 | |
| 7.1.1 | 37 / 1 | |
| 7.1.0 | 37 / 1 | |
| 7.0.0 | 37 / 1 | |
| 6.6.1 | 37 / 1 | |
| 6.6.0 | 37 / 1 | |
| 6.5.4 | 37 / 1 | |
| 6.5.3 | 37 / 1 | |
| 6.5.2 | 37 / 1 | |
| 6.5.1 | 37 / 1 | |
| 6.5.0 | 37 / 1 | |
| 6.4.2 | 38 / 1 | |
| 6.4.1 | 38 / 1 | |
| 6.4.0 | 38 / 1 | |
| 6.3.0 | 38 / 0 | |
| 6.2.4 | 38 / 0 | |
| 6.2.3 | 38 / 0 | |
| 6.2.2 | 38 / 0 | |
| 6.2.1 | 38 / 0 | |
| 6.2.0 | 38 / 0 | |
| 6.1.5 | 37 / 0 | |
| 6.1.2 | 37 / 0 | |
| 6.1.1 | 37 / 0 | |
| 6.1.0 | 37 / 0 | |
| 6.0.2 | 37 / 0 | |
| 6.0.0 | 37 / 0 | |
| 5.1.4 | 36 / 0 | |
| 5.1.3 | 36 / 0 | |
| 5.1.2 | 36 / 0 | |
| 5.1.1 | 36 / 0 | |
| 5.1.0 | 36 / 0 | |
| 5.0.0 | 36 / 0 | |
| 4.3.1 | 23 / 0 | |
| 4.3.0 | 23 / 0 | |
| 4.2.0 | 23 / 0 | |
| 4.1.1 | 23 / 0 | |
| 4.1.0 | 23 / 0 | |
| 4.0.0 | 23 / 0 | |
| 2.1.3 | 6 / 0 | |
| 2.1.2 | 6 / 0 | |
| 2.1.1 | 6 / 0 | |
| 2.1.0 | 6 / 0 | |
| 2.0.3 | 6 / 0 | |
| 2.0.2 | 6 / 0 | |
| 2.0.1 | 6 / 0 | |
| 2.0.0 | 6 / 0 | |
| 1.3.0 | 6 / 0 | |
| 1.2.0 | 6 / 0 | |
| 1.1.0 | 6 / 0 |
v7.4.0
2 findings
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
INFO
Publisher changed: tomayac → swissspidy (on 2025-11-19)
provenance
[Accepted risk] This version was published by a different npm account than previous versions on 2025-11-19. This could indicate a legitimate maintainer transition or an account compromise.
v6.5.4
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.