rwsdk
Build fast, server-driven webapps on Cloudflare with SSR, RSC, and realtime
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): CLI tool spreading process.env to pass environment to child processes with modified PATH — standard and expected pattern. | ai | |
| phantom-deps | phantom-dep:@types/glob | AI (phantom-deps): Framework-scoped @types package loaded by convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:@types/react | AI (phantom-deps): Framework-scoped @types package loaded by convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:@types/fs-extra | AI (phantom-deps): Framework-scoped @types package loaded by convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:@types/react-is | AI (phantom-deps): Framework-scoped @types package loaded by convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:@types/react-dom | AI (phantom-deps): Framework-scoped @types package loaded by convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:@types/decompress | AI (phantom-deps): Framework-scoped @types package loaded by convention, not directly imported. | ai | |
| phantom-deps | phantom-dep:@cloudflare/workers-types | AI (phantom-deps): Framework-scoped types package for Cloudflare Workers, loaded by convention in this SDK. | ai |
v1.2.5
2 findingsSpreading entire process.env into an object — may capture all secrets 21 | stdio: "inherit", 22 | reject: false, > 23 | env: { 24 | ...process.env, 25 | PATH: `${process.env.PATH}:${BIN_DIR}`,
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.2.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.