Security / Build Tooling

Subresource Integrity for Rollup.

Automatically generate Subresource Integrity hashes for assets produced by your Rollup build.

Get Started View on GitHub

$ npm i -D @darcas/rollup-sub-resource-integrity

Rollup Build

SHA‑384 Hash

Integrity Attr

Verified Resource

The problem

Your assets deserve integrity verification.

Every <script> and <link> you ship is fetched over the network and executed by the browser — without any guarantee that the file it receives is the file you built.

Subresource Integrity closes that gap: the browser refuses to run a resource whose content doesn't match the hash you published alongside it.

// before
<script src="/assets/app.js"></script>

x No integrity


// after
<script src="/assets/app.js"
        integrity="sha384-V9kQ…"
        crossorigin="anonymous"
></script>

✓ Integrity verified

Background

What is Subresource Integrity?

Subresource Integrity (SRI) is a browser security feature that lets you pin a cryptographic hash to every resource you load. The hash travels in the integrity attribute of the tag; before executing a script or applying a stylesheet, the browser hashes what it downloaded and compares it with what you declared.

If the two don't match — because the file was tampered with, corrupted, or served from an unexpected source — the browser blocks it. Nothing runs, nothing leaks.

It is the standard defense against compromised CDNs and man-in-the-middle modifications of third-party code. Read more on MDN.

How it works

From build to integrity.

01
Build
Rollup builds your assets exactly as it normally would.
02
Hash
The plugin reads each asset from the bundle and calculates its cryptographic hash.
03
Inject
Every emitted HTML file receives the integrity attribute on its matching tags.
04
Verify
The browser verifies each resource against its hash before executing it.

Before / After

Zero manual hash management.

The same HTML file, before and after the plugin runs. No hand-edited hashes, no drift between builds.

✕ Without Rollup SRI

<script type="module"
      src="/assets/index-abc123.js"
></script>

✕ Browser trusts the response blindly

✓ With Rollup SRI

<script type="module"
      src="/assets/index-abc123.js"
      integrity="sha384-V9kQ…"
      crossorigin="anonymous"
></script>

✓ Hash added automatically at build time

Features

Built for modern Rollup builds.

Automatic hashing

Every bundled asset referenced by your HTML gets its SHA-* hash computed at build time.

Rollup-native

A standard Rollup plugin that hooks into generateBundle — no extra build steps or wrappers.

Zero manual maintenance

Hashes are recalculated on every build. They can never drift from the assets they describe.

Production ready

Works with hashed filenames, code splitting and multi-page setups out of the box.

Security focused

Adds crossorigin="anonymous" alongside integrity so the browser verification actually applies.

Minimal configuration

One import, one call. Choose sha256, sha384 or sha512 — the default is sha384.

Usage

Add it to your Rollup build.

Import the plugin and add it to your plugin list. That's the entire configuration.

$ npm i -D @darcas/rollup-sub-resource-integrity

import { defineConfig } from 'vite'
import SubResourceIntegrity from '@darcas/rollup-sub-resource-integrity'

export default defineConfig({
  plugins: [
    SubResourceIntegrity(),
  ],
})

By default the plugin uses sha384. Pass 'sha256' or 'sha512' to choose a different algorithm.

Generated output

Your build. With integrity built in.

<script type="module"
      src="/assets/app-C8k92x.js"
      integrity="sha384-V9kQ…SaWq"
      crossorigin="anonymous"
></script>

Asset generated
Hash calculated
Integrity attribute added
Browser-ready

Developer experience

Security without the ceremony.

Add integrity verification to your build without introducing another complex workflow.

Manual workflow

Build your assets
Find every emitted file
Calculate hashes by hand
Update the HTML
Keep hashes synchronized on every rebuild

With Rollup SRI

Build your assets
✓ Done — hashes injected automatically

The plugin removes repetitive security-related build work — permanently.

Compatibility

Fits into your existing Rollup workflow.

A single peer dependency on Rollup itself. Vite projects work too, since Vite uses Rollup for production builds.

Rollup: ^2 · ^3 · ^4
Vite: Supported
Node.js: ≥ 18
Runtime deps: None

Security

Integrity you can verify.

Expected resource — declared in HTML

sha384-V9kQ3mZxL8fJ…

Downloaded resource — hashed by the browser

sha384-V9kQ3mZxL8fJ…

Browser verification — hash comparison

MATCH → executes

MISMATCH → blocked

Open source

Open source. Built for the ecosystem.

The full source is public and MIT licensed. Issues, discussions and pull requests are welcome.

View on GitHub

Ready to add integrity to your build?

Install Rollup Subresource Integrity and let your build handle the hashes for you.