@swc/wasm Apache-2.0 14 versions

@swc/wasm

npm Repository Homepage

wasm module for swc

Versions

Apache-2.0

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

kdy1

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:dynamic-require	AI (semgrep): The require(String.raw`util`) pattern is a static wasm-bindgen generated call to Node's built-in 'util' module. Not dynamic in any meaningful sense; stable false positive for this package.	ai	2026/04/24
license	uncommon-license:Apache-2.0/MIT	AI (license): Apache-2.0/MIT dual licensing is the standard license for the SWC project; permissive and well-understood.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): This is standard wasm-bindgen generated glue code for exposing WASM function creation to JS. Expected and stable across all versions of this package.	ai	2026/04/23
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Reflect.get() usage is standard wasm-bindgen generated glue code for property access bridging. Not obfuscation; expected in all versions of this package.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Established SWC ecosystem package; lack of Sigstore provenance is common and not a risk signal for this well-known publisher.	ai	2026/04/23

Hide prereleases