@donotdev/functions
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Fires in test files saving/restoring process.env — standard Jest pattern, not a secret leak. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Fires in a test asserting file:///etc/passwd is rejected as invalid URL — not credential harvesting. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): Fires in minified Firebase/AI SDK bundle; no exfiltration pattern visible in context. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires in minified supabase bundle; context shows normal SDK code, no payload decoding. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.1.42 | 3 / 0 | |
| 0.0.19 | 3 / 0 | |
| 0.0.18 | 3 / 0 | |
| 0.0.17 | 3 / 0 | |
| 0.0.16 | 3 / 0 | |
| 0.0.15 | 3 / 0 | |
| 0.0.14 | 3 / 0 | |
| 0.0.13 | 3 / 0 | |
| 0.0.12 | 3 / 0 | |
| 0.0.11 | 3 / 0 | |
| 0.0.10 | 2 / 0 | |
| 0.0.9 | 2 / 0 | |
| 0.0.8 | 2 / 0 | |
| 0.0.7 | 2 / 0 |
v0.1.42
6 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/functions/blob/3fa4ca5febca0aaf2d14187ef88256aa870b88db/src/shared/__tests__/detectFirestore.test.ts#L6 4 | 5 | describe('isFirestoreConfigured', () => { > 6 | const originalEnv = { ...process.env }; 7 | 8 | beforeEach(() => {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/functions/blob/3fa4ca5febca0aaf2d14187ef88256aa870b88db/src/shared/__tests__/internalValidation.test.ts#L165 163 | 164 | describe('validateStripeEnvironment (internal)', () => { > 165 | const originalEnv = { ...process.env }; 166 | 167 | beforeEach(() => {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/functions/blob/3fa4ca5febca0aaf2d14187ef88256aa870b88db/src/shared/__tests__/utils.test.ts#L266 264 | 265 | describe('validateStripeEnvironment', () => { > 266 | const originalEnv = { ...process.env }; 267 | 268 | beforeEach(() => {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/functions/blob/3fa4ca5febca0aaf2d14187ef88256aa870b88db/src/shared/__tests__/validation-env.test.ts#L6 4 | 5 | describe('validateEnvironment', () => { > 6 | const originalEnv = { ...process.env }; 7 | 8 | beforeEach(() => {
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/donotdev/functions/blob/3fa4ca5febca0aaf2d14187ef88256aa870b88db/src/shared/__tests__/validation.test.ts#L107 105 | it('rejects non-HTTP protocols', () => { 106 | expect(() => validateUrl('ftp://example.com')).toThrow('Invalid protocol'); > 107 | expect(() => validateUrl('file:///etc/passwd')).toThrow('Invalid protocol'); 108 | }); 109 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.14
4 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/functions/blob/770a9a76b51a52c6e379705973a992df43df2e90/src/shared/__tests__/detectFirestore.test.ts#L6 4 | 5 | describe('isFirestoreConfigured', () => { > 6 | const originalEnv = { ...process.env }; 7 | 8 | beforeEach(() => {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/donotdev/functions/blob/770a9a76b51a52c6e379705973a992df43df2e90/src/shared/__tests__/errorHandling.test.ts#L72 70 | 71 | describe('handleError', () => { > 72 | const originalEnv = { ...process.env }; 73 | 74 | beforeEach(() => {
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/donotdev/functions/blob/770a9a76b51a52c6e379705973a992df43df2e90/src/shared/__tests__/validation.test.ts#L107 105 | it('rejects non-HTTP protocols', () => { 106 | expect(() => validateUrl('ftp://example.com')).toThrow('Invalid protocol'); > 107 | expect(() => validateUrl('file:///etc/passwd')).toThrow('Invalid protocol'); 108 | }); 109 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.