lightningcss
A CSS parser, transformer, and minifier written in Rust
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): lightningcss routinely adds new platform-specific optional binary deps (e.g. freebsd-x64) as it expands platform support. This is the established pattern for NAPI-RS packages and not a supply-chain risk. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is a deliberate namespace reservation placeholder by the legitimate lightningcss author (devongovett). Stable false positive for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Intentional placeholder package by the legitimate lightningcss maintainer. No repo/keywords/deps/payload are expected for a namespace reservation. Stable false positive. | ai | |
| phantom-deps | phantom-dep:lightningcss-freebsd-x64 | AI (phantom-deps): Platform-specific optional binary dependency; dynamic require() at runtime is the documented pattern for native bindings. | ai | |
| provenance | no-provenance | AI (provenance): Established package with strong ecosystem trust; provenance attestation is a best-practice enhancement, not a security blocker. | ai | |
| phantom-deps | phantom-dep:lightningcss-linux-arm64-gnu | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads platform-specific binaries by name; standard native binding loader pattern, not arbitrary code execution. | ai | |
| phantom-deps | phantom-dep:lightningcss-darwin-x64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| dependencies | unvetted-dep:detect-libc | AI (dependencies): detect-libc is a standard utility for NAPI-RS/native addon packages to select the correct libc variant binary. Expected and benign for this package. | ai | |
| phantom-deps | phantom-dep:lightningcss-linux-arm64-musl | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| phantom-deps | phantom-dep:lightningcss-linux-arm-gnueabihf | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| phantom-deps | phantom-dep:lightningcss-darwin-arm64 | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase is TypeScript/Flow type definitions (ast.d.ts, ast.js.flow), standard build artifacts for mature packages. | ai | |
| phantom-deps | phantom-dep:lightningcss-linux-x64-gnu | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| phantom-deps | phantom-dep:lightningcss-linux-x64-musl | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai | |
| phantom-deps | phantom-dep:lightningcss-win32-x64-msvc | AI (phantom-deps): Platform-specific optional binary dependency; standard pattern for native bindings. | ai |
Versions (showing 42 of 42)
| Version | Deps | Published |
|---|---|---|
| 1.32.0 | 1 / 35 | |
| 1.31.1 | 1 / 35 | |
| 1.31.0 | 1 / 35 | |
| 1.30.2 | 1 / 35 | |
| 1.30.1 | 1 / 35 | |
| 1.30.0 | 1 / 35 | |
| 1.29.3 | 1 / 35 | |
| 1.29.2 | 1 / 35 | |
| 1.29.1 | 1 / 35 | |
| 1.29.0 | 1 / 35 | |
| 1.28.2 | 1 / 34 | |
| 1.28.1 | 1 / 34 | |
| 1.28.0 | 1 / 34 | |
| 1.27.0 | 1 / 34 | |
| 1.26.0 | 1 / 34 | |
| 1.25.1 | 1 / 34 | |
| 1.25.0 | 1 / 34 | |
| 1.24.1 | 1 / 34 | |
| 1.24.0 | 1 / 34 | |
| 1.23.0 | 1 / 33 | |
| 1.22.1 | 1 / 33 | |
| 1.22.0 | 10 / 33 | |
| 1.21.8 | 10 / 33 | |
| 1.21.7 | 10 / 33 | |
| 1.21.6 | 10 / 33 | |
| 1.21.5 | 9 / 33 | |
| 1.21.4 | 9 / 33 | |
| 1.21.3 | 9 / 33 | |
| 1.21.2 | 9 / 33 | |
| 1.21.1 | 9 / 33 | |
| 1.21.0 | 9 / 33 | |
| 1.20.0 | 9 / 33 | |
| 1.19.0 | 9 / 30 | |
| 1.18.0 | 9 / 30 | |
| 1.17.1 | 9 / 15 | |
| 1.17.0 | 9 / 15 | |
| 1.16.1 | 9 / 15 | |
| 1.16.0 | 9 / 15 | |
| 1.15.1 | 9 / 15 | |
| 1.15.0 | 9 / 15 | |
| 1.14.0 | 9 / 11 | |
| 0.0.0 | 0 / 0 |
v1.32.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.31.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.31.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.30.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.29.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.28.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.27.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.26.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.25.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.24.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.24.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.23.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.22.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.21.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.20.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.19.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.18.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.17.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.16.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.15.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.14.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.