@blackbelt-technology/pi-dashboard-extension
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Test fixture for symlink-escape path resolution, not real credential access. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard base64 decode of user-supplied image attachment data. | ai | |
| dependencies | unvetted-dep:@blackbelt-technology/pi-dashboard-bus-client | AI (dependencies): First-party sibling package from same monorepo/publisher. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Fires only in test files saving/restoring process.env — standard test pattern, not a data-exfiltration risk. | ai | |
| phantom-deps | phantom-dep:ws | AI (phantom-deps): ws is a declared runtime dependency in package.json; phantom-dep heuristic is a false positive here. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 0.7.0 | 5 / 3 | |
| 0.6.1 | 4 / 3 | |
| 0.6.0 | 4 / 3 | |
| 0.5.4 | 2 / 3 | |
| 0.5.3 | 2 / 3 | |
| 0.5.2 | 2 / 3 | |
| 0.5.1 | 2 / 3 | |
| 0.5.0 | 2 / 3 | |
| 0.4.6 | 2 / 3 | |
| 0.4.5 | 2 / 3 | |
| 0.4.4 | 2 / 3 | |
| 0.4.3 | 2 / 3 | |
| 0.4.2 | 2 / 3 | |
| 0.4.1 | 2 / 3 | |
| 0.3.0 | 2 / 2 |
v0.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.0
5 findingsAccessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/BlackBeltTechnology/pi-agent-dashboard/blob/70c087ba97d3b7a9997767f7c9c758ac49d998f2/src/__tests__/artifact-roots.test.ts#L53 51 | "/home/pi/.agent-browser/tmp/shot.png": "/home/pi/.agent-browser/tmp/shot.png", 52 | "/home/pi/.agent-browser/tmp/sub/a.png": "/home/pi/.agent-browser/tmp/sub/a.png", > 53 | "/etc/passwd.png": "/etc/passwd.png", 54 | "/home/pi/secret.png": "/home/pi/secret.png", 55 | // symlink escape: realpath resolves outside the root
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/BlackBeltTechnology/pi-agent-dashboard/blob/70c087ba97d3b7a9997767f7c9c758ac49d998f2/src/__tests__/artifact-roots.test.ts#L53 51 | "/home/pi/.agent-browser/tmp/shot.png": "/home/pi/.agent-browser/tmp/shot.png", 52 | "/home/pi/.agent-browser/tmp/sub/a.png": "/home/pi/.agent-browser/tmp/sub/a.png", > 53 | "/etc/passwd.png": "/etc/passwd.png", 54 | "/home/pi/secret.png": "/home/pi/secret.png", 55 | // symlink escape: realpath resolves outside the root
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/BlackBeltTechnology/pi-agent-dashboard/blob/70c087ba97d3b7a9997767f7c9c758ac49d998f2/src/__tests__/artifact-roots.test.ts#L56 54 | "/home/pi/secret.png": "/home/pi/secret.png", 55 | // symlink escape: realpath resolves outside the root > 56 | "/home/pi/.agent-browser/tmp/evil.png": "/etc/shadow.png", 57 | }); 58 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/BlackBeltTechnology/pi-agent-dashboard/blob/70c087ba97d3b7a9997767f7c9c758ac49d998f2/src/__tests__/artifact-roots.test.ts#L68 66 | 67 | it("rejects a path outside every root", () => { > 68 | expect(isUnderArtifactRoot("/etc/passwd.png", roots, rp)).toBe(false); 69 | expect(isUnderArtifactRoot("/home/pi/secret.png", roots, rp)).toBe(false); 70 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.