← Home

@akanjs/devkit

npm Repository Homepage

This package is a sub-library of akanjs. For more information, please refer to [@akanjs/cli](https://www.npmjs.com/package/@akanjs/cli) and the [Akan.js Github](https://github.com/akan-team/akanjs).

31
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

akamir-bassman

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:akanjs AI (dependencies): Sibling package from same monorepo/org, pinned exact version. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Local test fixture IP in capacitorApp.test.ts, not a live exfil target. ai
semgrep semgrep:env-spread AI (semgrep): Test file backing up env for restoration, not exfiltration. ai
phantom-deps phantom-dep:daisyui AI (phantom-deps): Used via config file, not import; expected for CSS framework. ai
phantom-deps phantom-dep:tailwind-scrollbar AI (phantom-deps): Used via config file, not import; expected for CSS plugin. ai
semgrep semgrep:env-bulk-read AI (semgrep): Filters env vars by regex into publicEnv for config exposure, standard pattern. ai
semgrep semgrep:child-process-import AI (semgrep): Executors module in a devkit legitimately uses child_process to run build/deploy commands. ai

Versions (showing 31 of 31)

Version Deps Published
2.3.10 22 / 0
2.3.9 22 / 0
2.2.9 22 / 0
2.2.6 22 / 0
1.0.21 21 / 0
1.0.20 21 / 0
1.0.19 21 / 0
1.0.18 21 / 0
1.0.17 21 / 0
1.0.16 21 / 0
1.0.15 21 / 0
1.0.14 21 / 0
1.0.13 21 / 0
1.0.12 21 / 0
1.0.11 21 / 0
1.0.10 21 / 0
1.0.9 21 / 0
1.0.8 21 / 0
1.0.7 21 / 0
1.0.6 21 / 0
1.0.5 21 / 0
1.0.4 21 / 0
1.0.3 21 / 0
1.0.2 21 / 0
1.0.1 21 / 0
1.0.0 21 / 0
0.9.59 20 / 0
0.9.58 20 / 0
0.9.57 20 / 0
0.9.56 20 / 0
0.9.55 20 / 0

v2.3.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.3.9

8 findings
HIGH shady-links-raw-ip: capacitorApp.test.ts:98 semgrep

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/capacitorApp.test.ts#L98 96 | operation: "local", 97 | localIp: "192.168.0.5", > 98 | localServerUrl: "http://192.168.0.5:8282/en/admin?csr=true&akanMobileTarget=default", 99 | }, 100 | );

HIGH shady-links-raw-ip: capacitorApp.test.ts:105 semgrep

HTTP request to raw IP address — legitimate packages use domain names Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/capacitorApp.test.ts#L105 103 | hostname: "localhost", 104 | androidScheme: "http", > 105 | url: "http://192.168.0.5:8282/en/admin?csr=true&akanMobileTarget=default", 106 | cleartext: true, 107 | allowNavigation: ["api.example.com", "192.168.0.5", "localhost"],

HIGH env-spread: executors.test.ts:10 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/executors.test.ts#L10 8 | import type { PackageJson } from "./types"; 9 | > 10 | const originalEnv = { ...process.env }; 11 | const tempRoots: string[] = []; 12 |

HIGH env-spread: executors.ts:782 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/executors.ts#L782 780 | const proc = Bun.spawn([process.execPath, entry], { 781 | cwd: this.cwdPath, > 782 | env: { 783 | ...process.env, 784 | AKAN_TYPECHECK_CWD: this.cwdPath,

HIGH env-spread: executors.ts:872 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/executors.ts#L872 870 | static getBaseDevEnv(envPath?: string) { 871 | // Bun auto-loads .env, so we use process.env directly > 872 | const sourceEnv = envPath ? { ...process.env, ...parseEnvFile(envPath) } : process.env; 873 | 874 | const appName = sourceEnv.AKAN_PUBLIC_APP_NAME;

HIGH env-spread: executors.ts:1366 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/executors.ts#L1366 1364 | const PORT = (basePort + portOffset).toString(); 1365 | const AKAN_PUBLIC_SERVER_PORT = portOffset ? (8282 + portOffset).toString() : undefined; > 1366 | return { 1367 | ...process.env, 1368 | AKAN_PUBLIC_APP_NAME: this.name,

HIGH env-spread: integration/devStabilityHarness.ts:259 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/akan-team/akanjs/blob/ff597cabc64c270ab0fc2f008414994a7282d9c5/integration/devStabilityHarness.ts#L259 257 | const proc = Bun.spawn(["bash", "-lc", `bun run akan start ${JSON.stringify(this.appName)}`], { 258 | cwd: this.workspaceRoot, > 259 | env: { 260 | ...process.env, 261 | AKAN_VERBOSE: "1",

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.