@geekmidas/services
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Fires only in test code passing process.env to EnvironmentParser — the intended API; not a runtime secret exposure. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.0.2 | 0 / 2 | |
| 1.0.1 | 0 / 2 | |
| 1.0.0 | 0 / 2 | |
| 0.2.0 | 0 / 2 | |
| 0.1.0 | 0 / 2 | |
| 0.0.1 | 1 / 0 |
v1.0.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.0.1
3 findingsSpreading entire process.env into an object — may capture all secrets 12 | beforeEach(() => { 13 | _logger = new ConsoleLogger({ app: 'test' }); > 14 | envParser = new EnvironmentParser({ ...process.env }); 15 | 16 | // Reset singleton between tests
Spreading entire process.env into an object — may capture all secrets 463 | async register() { 464 | // Create a new EnvironmentParser instance for service-specific config > 465 | const serviceEnv = new EnvironmentParser({ ...process.env }); 466 | const config = serviceEnv 467 | .create((get) => ({
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.0.0
3 findingsSpreading entire process.env into an object — may capture all secrets 12 | beforeEach(() => { 13 | _logger = new ConsoleLogger({ app: 'test' }); > 14 | envParser = new EnvironmentParser({ ...process.env }); 15 | 16 | // Reset singleton between tests
Spreading entire process.env into an object — may capture all secrets 463 | async register() { 464 | // Create a new EnvironmentParser instance for service-specific config > 465 | const serviceEnv = new EnvironmentParser({ ...process.env }); 466 | const config = serviceEnv 467 | .create((get) => ({
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.0
3 findingsSpreading entire process.env into an object — may capture all secrets 12 | beforeEach(() => { 13 | _logger = new ConsoleLogger({ app: 'test' }); > 14 | envParser = new EnvironmentParser({ ...process.env }); 15 | 16 | // Reset singleton between tests
Spreading entire process.env into an object — may capture all secrets 463 | async register() { 464 | // Create a new EnvironmentParser instance for service-specific config > 465 | const serviceEnv = new EnvironmentParser({ ...process.env }); 466 | const config = serviceEnv 467 | .create((get) => ({
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
3 findingsSpreading entire process.env into an object — may capture all secrets 11 | beforeEach(() => { 12 | logger = new ConsoleLogger({ app: 'test' }); > 13 | envParser = new EnvironmentParser({ ...process.env }); 14 | 15 | // Reset singleton between tests
Spreading entire process.env into an object — may capture all secrets 465 | async register() { 466 | // Create a new EnvironmentParser instance for service-specific config > 467 | const serviceEnv = new EnvironmentParser({ ...process.env }); 468 | const config = serviceEnv 469 | .create((get) => ({
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.0.1
3 findingsSpreading entire process.env into an object — may capture all secrets 11 | beforeEach(() => { 12 | logger = new ConsoleLogger({ app: 'test' }); > 13 | envParser = new EnvironmentParser({ ...process.env }); 14 | 15 | // Reset singleton between tests
Spreading entire process.env into an object — may capture all secrets 465 | async register() { 466 | // Create a new EnvironmentParser instance for service-specific config > 467 | const serviceEnv = new EnvironmentParser({ ...process.env }); 468 | const config = serviceEnv 469 | .create((get) => ({
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.