@electron-forge/core
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:cors | AI (typosquat): Scoped official electron-forge package; not a typosquat of cors. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Passing env to spawned child process during dev start; standard CLI pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Plugin/template loader resolves config-supplied paths; stable for this build tool. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in a config proxy handler; not obfuscation. | ai | |
| dependencies | unvetted-dep:yarn-or-npm | AI (dependencies): Long-standing legit dep of electron-forge. | ai | |
| dependencies | unvetted-dep:resolve-package | AI (dependencies): Established dep used to resolve template packages. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 7.11.2 | 34 / 18 | |
| 7.11.1 | 34 / 18 | |
| 7.11.0 | 34 / 18 | |
| 7.6.0 | 35 / 23 | |
| 7.5.0 | 35 / 23 |
v7.11.2
3 findingsPackage name '@electron-forge/core' is 1 edit(s) away from popular package 'cors'.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/forge/blob/f2a3ec8aa9c836aff95fcd83ce9c99842f0cda8a/src/api/start.ts#L230 228 | cwd: dir, 229 | stdio: 'inherit', > 230 | env: { 231 | ...process.env, 232 | ...(enableLogging
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.11.1
3 findingsPackage name '@electron-forge/core' is 1 edit(s) away from popular package 'cors'.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/forge/blob/eb0a845a922c841219c3a2e43bd99dae7ba89a90/src/api/start.ts#L230 228 | cwd: dir, 229 | stdio: 'inherit', > 230 | env: { 231 | ...process.env, 232 | ...(enableLogging
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.11.0
3 findingsPackage name '@electron-forge/core' is 1 edit(s) away from popular package 'cors'.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/forge/blob/55ddb0b5d9eba8e6e15c43315b5c21aa5ed11077/src/api/start.ts#L230 228 | cwd: dir, 229 | stdio: 'inherit', > 230 | env: { 231 | ...process.env, 232 | ...(enableLogging
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v7.6.0
3 findingsPackage name '@electron-forge/core' is 1 edit(s) away from popular package 'cors'.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/forge/blob/37a66f2a42e2ea74a30d168a32aff69c90cc20b9/src/api/start.ts#L174 172 | cwd: dir, 173 | stdio: 'inherit', > 174 | env: { 175 | ...process.env, 176 | ...(enableLogging
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v7.5.0
3 findingsPackage name '@electron-forge/core' is 1 edit(s) away from popular package 'cors'.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/forge/blob/5941a9a067c8af0daee0aab01c44a0040a9bdea0/src/api/start.ts#L165 163 | cwd: dir, 164 | stdio: 'inherit', > 165 | env: { 166 | ...process.env, 167 | ...(enableLogging
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.