@remix-run/web-form-data
Web API compatible Form Data implementation
5
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
chancestricklandmjackson
Keywords
formdatatyped
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:web-encoding | AI (dependencies): web-encoding is a well-known Web Encoding API polyfill appropriate for this package's purpose as a FormData implementation targeting Node.js environments. | ai | |
| bogus-package | bogus-package | AI (bogus-package): False positive: @remix-run/web-form-data is a legitimate standards-track polyfill under the @remix-run org, published by mjackson. Spam signals (co-maintainer flag, README links, semver) do not apply to this established package. | ai | |
| provenance | no-provenance | AI (provenance): Established Remix Run package from trusted publisher mjackson; lack of provenance attestation is not a security concern for this package. | ai | |
| phantom-deps | phantom-dep:web-encoding | AI (phantom-deps): web-encoding is a declared dependency used in build/config context for CJS compatibility; phantom-dep finding is a false positive for this build pattern. | ai |