@dotcom-tool-kit/node
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): Package's core purpose is forking Node processes; child_process use is intentional and documented. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading env into fork() call is the intended mechanism for injecting Doppler secrets into child processes. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): zod is a legitimate dependency of this package, not a target being impersonated; false positive. | ai | |
| phantom-deps | phantom-dep:@dotcom-tool-kit/error | AI (phantom-deps): Same-org sibling dep; likely used transitively or in type declarations; stable false positive. | ai |
v5.1.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/financial-times/dotcom-tool-kit/blob/9e7c6026c270dddb1da48051fa70474bc404b3a9/lib/tasks/node.js#L58 56 | this.logger.verbose('starting the child node process...'); 57 | this.child = (0, child_process_1.fork)(path_1.default.resolve(cwd, entry), args, { > 58 | env: { 59 | ...dopplerEnv, 60 | PORT: port.toString(),
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/financial-times/dotcom-tool-kit/blob/cfaa84f2a3c995a578e6c6f21d4c9d79e1be9756/lib/tasks/node.js#L54 52 | this.logger.verbose('starting the child node process...'); 53 | this.child = (0, child_process_1.fork)(path_1.default.resolve(cwd, entry), args, { > 54 | env: { 55 | ...dopplerEnv, 56 | PORT: port.toString(),
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.