rollup-plugin-node-polyfills
rollup-plugin-node-polyfills ===
5
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
manucorporat
Keywords
rollup-plugin
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function() in setimmediate.js is a faithful implementation of the setimmediate spec, which allows string callbacks. This is standard polyfill behavior, not a security risk. | ai | |
| provenance | no-provenance | AI (provenance): Package is 2500+ days old, predating Sigstore provenance. Published by the Ionic team with a verifiable GitHub repo. Absence of provenance is expected for packages of this age. | ai |