@dotcom-tool-kit/serverless
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): Package's core purpose is spawning the serverless CLI; child_process use is intentional and stable. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading Doppler env vars into child process env is the intended design for this serverless runner tool. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 4.2.0 | 9 / 0 | |
| 4.1.0 | 9 / 0 | |
| 4.0.2 | 9 / 0 | |
| 4.0.1 | 9 / 0 | |
| 4.0.0 | 9 / 0 |
v4.2.0
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/financial-times/dotcom-tool-kit/blob/5d5b72f0c5a0a098aee9dfc4b14a03504012ac6d/lib/tasks/run.js#L46 44 | } 45 | this.child = (0, child_process_1.spawn)('serverless', args, { > 46 | env: { 47 | ...dopplerEnv, 48 | PORT: port.toString(),
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/financial-times/dotcom-tool-kit/blob/5d5b72f0c5a0a098aee9dfc4b14a03504012ac6d/src/tasks/run.ts#L60 58 | 59 | this.child = spawn('serverless', args, { > 60 | env: { 61 | ...dopplerEnv, 62 | PORT: port.toString(),
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/financial-times/dotcom-tool-kit/blob/ae77eaf8bcb6bd3df3068770997c7f8cbe50a972/lib/tasks/run.js#L46 44 | } 45 | this.child = (0, child_process_1.spawn)('serverless', args, { > 46 | env: { 47 | ...dopplerEnv, 48 | PORT: port.toString(),
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.