@clerk/dev-cli
CLI tool designed to simplify the process of iterating on packages within the clerk/javascript repository
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): This is a developer CLI tool that spawns subprocesses (e.g., $VISUAL editor). Passing process.env to spawn() is standard and correct behavior for CLI tools — not credential exfiltration. Stable false positive for this package. | ai |
v0.1.0
9 findingsSpreading entire process.env into an object — may capture all secrets 11 | spawn(process.env.VISUAL, [CONFIG_FILE], { 12 | stdio: 'inherit', > 13 | env: { 14 | ...process.env, 15 | },
Spreading entire process.env into an object — may capture all secrets 18 | spawn(process.env.EDITOR, [CONFIG_FILE], { 19 | stdio: 'inherit', > 20 | env: { 21 | ...process.env, 22 | },
Spreading entire process.env into an object — may capture all secrets 42 | spawn(process.env.VISUAL, [CONFIG_FILE], { 43 | stdio: 'inherit', > 44 | env: { 45 | ...process.env, 46 | },
Spreading entire process.env into an object — may capture all secrets 50 | spawn(process.env.EDITOR, [CONFIG_FILE], { 51 | stdio: 'inherit', > 52 | env: { 53 | ...process.env, 54 | },
Spreading entire process.env into an object — may capture all secrets 178 | const child = spawn('pnpm', ['import'], { 179 | stdio: 'inherit', > 180 | env: { 181 | ...process.env, 182 | },
Spreading entire process.env into an object — may capture all secrets 213 | const child = spawn('pnpm', args, { 214 | stdio: 'inherit', > 215 | env: { 216 | ...process.env, 217 | },
Spreading entire process.env into an object — may capture all secrets 35 | command: 'turbo run dev --filter=@clerk/clerk-js -- --env devOrigin=http://localhost:4000', 36 | cwd, > 37 | env: { TURBO_UI: '0', ...process.env }, 38 | }; 39 |
Spreading entire process.env into an object — may capture all secrets 43 | command: `turbo ${args.join(' ')}`, 44 | cwd, > 45 | env: { TURBO_UI: '0', ...process.env }, 46 | }; 47 |
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.