@eeacms/volto-eea-chatbot
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Test asserting path traversal to /etc/passwd is blocked, not actual access. | ai | |
| phantom-deps | phantom-dep:@eeacms/volto-design-tokens | AI (phantom-deps): Same-org Volto addon, used via config not direct import. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires in .eslintrc.js loading tsconfig paths — standard build tooling, not runtime code. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): uuid is declared in dependencies; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@plone-collective/volto-sentry | AI (phantom-deps): Volto add-on dependency wired via config, not direct import; stable false positive for this package. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 3.0.0 | 15 / 18 | |
| 2.0.5 | 14 / 18 | |
| 2.0.4 | 14 / 18 | |
| 2.0.3 | 14 / 18 | |
| 2.0.2 | 14 / 18 | |
| 2.0.1 | 14 / 18 | |
| 2.0.0 | 14 / 18 | |
| 1.0.13 | 14 / 18 | |
| 1.0.12 | 14 / 18 | |
| 1.0.11 | 13 / 18 | |
| 1.0.10 | 13 / 18 | |
| 1.0.9 | 13 / 18 |
v3.0.0
4 findingsAccessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: ssh://[email protected]/eea/volto-eea-chatbot/blob/62374a48e0b0f39a7a73b2df1bc16fe139dc5317/src/halloumi/middleware.test.js#L186 184 | ); 185 | expect( > 186 | isPathAllowed('/../../etc/passwd', 'POST', ALLOWED_HALLOUMI_PATHS), 187 | ).toBe(false); 188 | });
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: ssh://[email protected]/eea/volto-eea-chatbot/blob/62374a48e0b0f39a7a73b2df1bc16fe139dc5317/src/middleware.test.js#L267 265 | process.env.ONYX_API_KEY = 'test-key'; 266 | process.env.ONYX_URL = 'http://localhost:3000'; > 267 | req.url = '/_da/../../etc/passwd'; 268 | req.method = 'GET'; 269 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: ssh://[email protected]/eea/volto-eea-chatbot/blob/62374a48e0b0f39a7a73b2df1bc16fe139dc5317/src/middleware.test.js#L311 309 | isPathAllowed('/admin/users/delete', 'POST', ALLOWED_PROXY_PATHS), 310 | ).toBe(false); > 311 | expect(isPathAllowed('/../../etc/passwd', 'GET', ALLOWED_PROXY_PATHS)).toBe( 312 | false, 313 | );
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.5
4 findingsAccessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: ssh://[email protected]/eea/volto-eea-chatbot/blob/2345a18124c3e089e12984b8b406aea37924fa2c/src/halloumi/middleware.test.js#L186 184 | ); 185 | expect( > 186 | isPathAllowed('/../../etc/passwd', 'POST', ALLOWED_HALLOUMI_PATHS), 187 | ).toBe(false); 188 | });
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: ssh://[email protected]/eea/volto-eea-chatbot/blob/2345a18124c3e089e12984b8b406aea37924fa2c/src/middleware.test.js#L267 265 | process.env.ONYX_API_KEY = 'test-key'; 266 | process.env.ONYX_URL = 'http://localhost:3000'; > 267 | req.url = '/_da/../../etc/passwd'; 268 | req.method = 'GET'; 269 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: ssh://[email protected]/eea/volto-eea-chatbot/blob/2345a18124c3e089e12984b8b406aea37924fa2c/src/middleware.test.js#L311 309 | isPathAllowed('/admin/users/delete', 'POST', ALLOWED_PROXY_PATHS), 310 | ).toBe(false); > 311 | expect(isPathAllowed('/../../etc/passwd', 'GET', ALLOWED_PROXY_PATHS)).toBe( 312 | false, 313 | );
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.