← Home

webpack-plugin-serve

npm Repository Homepage

A Development Server in a Webpack Plugin

8
Versions
MPL-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

shellscape

Keywords

devdevelopmentdevserverserveserverwebpack

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance no-provenance AI (provenance): Mature package from established publisher; provenance absence is best-practice gap, not security risk. ai
phantom-deps phantom-dep:@types/koa AI (phantom-deps): TypeScript type definitions loaded by convention; standard practice for typed projects. ai
phantom-deps phantom-dep:@types/webpack AI (phantom-deps): TypeScript type definitions loaded by convention; standard practice for typed projects. ai
phantom-deps phantom-dep:@types/http-proxy-middleware AI (phantom-deps): TypeScript type definitions loaded by convention; standard practice for typed projects. ai
publish-pattern new-deps-added AI (publish-pattern): safe-stable-stringify is a well-known, legitimate utility package. Its addition is consistent with the plugin's purpose of serializing data safely. No malicious indicators. ai
dependencies unvetted-dep:onetime AI (dependencies): onetime is a well-known sindresorhus utility with no malicious history; stable false positive for this package. ai

Versions (showing 8 of 8)

Version Deps Published
1.6.0 23 / 19
1.2.0 22 / 18
1.1.0 22 / 17
0.12.0 22 / 20
0.11.0 18 / 20
0.7.0 20 / 23
0.4.0 17 / 20
0.1.2 15 / 17

v1.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.12.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.11.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.7.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.