@rspack/binding MIT 7 versions

@rspack/binding

npm Repository Homepage

Node binding for rspack

Versions

MIT

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

hardfistchenjiahan

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): rspack migrated to GitHub Actions CI publishing with SLSA provenance attestation. This is a legitimate, security-improving transition for this established package.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): Established rspack native binding package; spam signals are false positives — hardfist is a known rspack maintainer, short README and no keywords are typical for platform binding packages.	ai	2026/04/23
semgrep	semgrep:child-process-import	AI (semgrep): execSync('ldd --version') is standard napi-rs pattern to detect musl libc for selecting the correct prebuilt binary. Benign and stable for this package.	ai	2026/04/23
semgrep	semgrep:child-process-execsync	AI (semgrep): execSync('ldd --version') is standard napi-rs musl detection pattern. Benign and stable for this native binding package.	ai	2026/04/23
semgrep	semgrep:dynamic-require	AI (semgrep): require(process.env.NAPI_RS_NATIVE_LIBRARY_PATH) is a documented napi-rs override mechanism for the native library path. Benign and stable for this package.	ai	2026/04/23

Hide prereleases