@checkstack/backend-api
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Test asserting guarded-fetch blocks /etc/passwd access; defensive test, not real access. | ai | |
| provenance | missing-githead | AI (provenance): No material change from prior approved version; likely CI environment variance. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Internal tooling package consistently lacks description. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal scoped tooling package; no repo/description is expected in this monorepo context. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Added dep is @opentelemetry/api, a standard well-known telemetry library. | ai | |
| dependencies | unvetted-dep:@checkstack/template-engine | AI (dependencies): Internal monorepo sibling package, consistent with other @checkstack deps. | ai | |
| semgrep | semgrep:dll-injection-apis | AI (semgrep): Fires on comments/docs describing a denylist that drops LD_PRELOAD — defensive code, not injection. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Fires in SSRF guard test fixtures using example IPs — not a real outbound request. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Used in encryption.ts to decode IV, auth tag, and ciphertext — standard AES-GCM decryption pattern. | ai | |
| phantom-deps | phantom-dep:@orpc/openapi | AI (phantom-deps): Re-exported via config files rather than direct import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@orpc/client | AI (phantom-deps): Re-exported via config files rather than direct import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@orpc/zod | AI (phantom-deps): Re-exported via config files rather than direct import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:hono | AI (phantom-deps): hono is declared as a peerDependency; phantom-dep false positive for peer deps. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Used in encryption.ts to parse AES key from hex string — standard crypto pattern, not obfuscation. | ai |
Versions (showing 41 of 41)
| Version | Deps | Published |
|---|---|---|
| 0.34.0 | 18 / 7 | |
| 0.33.0 | 17 / 6 | |
| 0.31.0 | 17 / 6 | |
| 0.30.0 | 16 / 6 | |
| 0.26.0 | 16 / 6 | |
| 0.20.0 | 14 / 5 | |
| 0.19.0 | 14 / 5 | |
| 0.18.0 | 14 / 3 | |
| 0.17.1 | 14 / 3 | |
| 0.17.0 | 14 / 3 | |
| 0.16.0 | 14 / 3 | |
| 0.15.3 | 14 / 3 | |
| 0.15.2 | 14 / 3 | |
| 0.15.1 | 14 / 3 | |
| 0.15.0 | 14 / 3 | |
| 0.14.1 | 14 / 3 | |
| 0.14.0 | 14 / 3 | |
| 0.13.1 | 14 / 3 | |
| 0.12.0 | 13 / 3 | |
| 0.11.1 | 13 / 3 | |
| 0.11.0 | 13 / 3 | |
| 0.10.1 | 13 / 3 | |
| 0.10.0 | 13 / 3 | |
| 0.9.0 | 13 / 3 | |
| 0.8.2 | 13 / 3 | |
| 0.8.1 | 12 / 3 | |
| 0.8.0 | 12 / 3 | |
| 0.7.0 | 12 / 3 | |
| 0.6.0 | 11 / 3 | |
| 0.5.2 | 11 / 3 | |
| 0.5.1 | 11 / 3 | |
| 0.5.0 | 11 / 3 | |
| 0.4.1 | 11 / 3 | |
| 0.4.0 | 11 / 3 | |
| 0.3.3 | 11 / 3 | |
| 0.3.2 | 11 / 3 | |
| 0.3.1 | 11 / 3 | |
| 0.3.0 | 11 / 3 | |
| 0.2.0 | 11 / 3 | |
| 0.1.0 | 11 / 3 | |
| 0.0.2 | 11 / 3 |
v0.34.0
2 findingsAccessing /etc/passwd or /etc/shadow — credential harvesting on Linux 42 | return new Response(null); 43 | }) as unknown as typeof fetch; > 44 | await expect(guarded(fetchImpl)("file:///etc/passwd")).rejects.toBeInstanceOf( 45 | GuardedFetchError, 46 | );
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.33.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.17.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: enyineer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.2
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: enyineer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.15.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: enyineer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.14.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: enyineer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.13.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: enyineer.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.