@cabinetdocs/cli
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into child_process options is standard CLI practice; not credential theft. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @cabinetdocs/cli has no semantic similarity to joi; edit-distance match is a false positive. | ai |
v0.2.0
4 findingsSpreading entire process.env into an object — may capture all secrets 24 | await runCommand('npx', ['nuxt', 'generate'], { 25 | cwd: resolve(process.cwd(), 'node_modules/@cabinetdocs/core'), > 26 | env: { 27 | ...process.env, 28 | CABINET_TITLE: config.title || '',
Spreading entire process.env into an object — may capture all secrets 53 | cwd: resolve(process.cwd(), `node_modules/${previewPkg}`), 54 | stdio: 'inherit', > 55 | env: { 56 | ...process.env, 57 | CABINET_EXAMPLES_DIR: resolve(process.cwd(), config.examples || './docs/examples'),
Spreading entire process.env into an object — may capture all secrets 80 | cwd: resolve(process.cwd(), `node_modules/${corePkg}`), 81 | stdio: 'inherit', > 82 | env: { 83 | ...process.env, 84 | CABINET_TITLE: config.title || '',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
4 findingsSpreading entire process.env into an object — may capture all secrets 24 | await runCommand('npx', ['nuxt', 'generate'], { 25 | cwd: resolve(process.cwd(), 'node_modules/@cabinetdocs/core'), > 26 | env: { 27 | ...process.env, 28 | CABINET_TITLE: config.title || '',
Spreading entire process.env into an object — may capture all secrets 57 | cwd: resolve(process.cwd(), `node_modules/${previewPkg}`), 58 | stdio: 'inherit', > 59 | env: { 60 | ...process.env, 61 | CABINET_EXAMPLES_DIR: resolve(process.cwd(), config.examples || './docs/examples'),
Spreading entire process.env into an object — may capture all secrets 82 | cwd: resolve(process.cwd(), 'node_modules/@cabinetdocs/core'), 83 | stdio: 'inherit', > 84 | env: { 85 | ...process.env, 86 | // Pass cabinet config as env vars for runtimeConfig
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
4 findingsSpreading entire process.env into an object — may capture all secrets 24 | await runCommand('npx', ['nuxt', 'generate'], { 25 | cwd: resolve(process.cwd(), 'node_modules/@cabinetdocs/core'), > 26 | env: { 27 | ...process.env, 28 | CABINET_TITLE: config.title || '',
Spreading entire process.env into an object — may capture all secrets 57 | cwd: resolve(process.cwd(), `node_modules/${previewPkg}`), 58 | stdio: 'inherit', > 59 | env: { 60 | ...process.env, 61 | CABINET_EXAMPLES_DIR: resolve(process.cwd(), config.examples || './docs/examples'),
Spreading entire process.env into an object — may capture all secrets 82 | cwd: resolve(process.cwd(), 'node_modules/@cabinetdocs/core'), 83 | stdio: 'inherit', > 84 | env: { 85 | ...process.env, 86 | // Pass cabinet config as env vars for runtimeConfig
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.