@icgio/clients-config
Centralized configuration management for ICG trading clients. Contains client trading configurations and protected secret files managed with git-secret.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dynamic-require | AI (semgrep): safe_require wrapper with MODULE_NOT_FOUND guard; stable benign pattern for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal scoped config package; sparse README/keywords expected for private tooling. | ai | |
| semgrep | semgrep:child-process-import | FP: child_process is git-secret reveal (local decrypt), not exec of remote payload. | sean | |
| install-scripts | install-script:postinstall | FP: reveal-secrets-on-install uses git-secret to DECRYPT bundled files with consumer key. No exfil/remote. | sean |
Versions (showing 51 of 330)
| Version | Deps | Published |
|---|---|---|
| 1.0.385 | 1 / 3 | |
| 1.0.384 | 1 / 3 | |
| 1.0.383 | 1 / 3 | |
| 1.0.382 | 1 / 3 | |
| 1.0.381 | 1 / 3 | |
| 1.0.380 | 1 / 3 | |
| 1.0.379 | 1 / 3 | |
| 1.0.378 | 1 / 3 | |
| 1.0.377 | 1 / 3 | |
| 1.0.376 | 1 / 3 | |
| 1.0.375 | 1 / 3 | |
| 1.0.374 | 1 / 3 | |
| 1.0.373 | 1 / 3 | |
| 1.0.372 | 1 / 3 | |
| 1.0.371 | 1 / 3 | |
| 1.0.370 | 1 / 3 | |
| 1.0.369 | 1 / 3 | |
| 1.0.368 | 1 / 3 | |
| 1.0.367 | 1 / 3 | |
| 1.0.366 | 1 / 3 | |
| 1.0.365 | 1 / 3 | |
| 1.0.364 | 1 / 3 | |
| 1.0.363 | 1 / 3 | |
| 1.0.362 | 1 / 3 | |
| 1.0.361 | 1 / 3 | |
| 1.0.360 | 1 / 3 | |
| 1.0.359 | 1 / 3 | |
| 1.0.358 | 1 / 3 | |
| 1.0.357 | 1 / 3 | |
| 1.0.356 | 1 / 3 | |
| 1.0.355 | 1 / 3 | |
| 1.0.354 | 1 / 3 | |
| 1.0.353 | 1 / 3 | |
| 1.0.352 | 1 / 3 | |
| 1.0.351 | 1 / 3 | |
| 1.0.350 | 1 / 3 | |
| 1.0.349 | 1 / 3 | |
| 1.0.348 | 1 / 3 | |
| 1.0.346 | 1 / 3 | |
| 1.0.345 | 1 / 3 | |
| 1.0.344 | 1 / 3 | |
| 1.0.343 | 1 / 3 | |
| 1.0.342 | 1 / 3 | |
| 1.0.341 | 1 / 3 | |
| 1.0.340 | 1 / 3 | |
| 1.0.339 | 1 / 3 | |
| 1.0.338 | 1 / 3 | |
| 1.0.337 | 1 / 3 | |
| 1.0.336 | 1 / 3 | |
| 1.0.335 | 1 / 3 | |
| 1.0.334 | 1 / 3 |
v1.0.385
4 findings[Reject — re-review on republish] (prior reject: AI (install-scripts): Postinstall runs a script explicitly named to steal secrets via child_process; malicious by design across all versions.) Script: node ./scripts/reveal-secrets-on-install.js
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/2169ede738b188f5c5e86a8c1701c0c1ef9250cc/scripts/reveal-secrets-on-install.js#L5 3 | const fs = require('fs') 4 | const path = require('path') > 5 | const { spawnSync } = require('child_process') 6 | 7 | const pkgRoot = path.resolve(__dirname, '..')
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/2169ede738b188f5c5e86a8c1701c0c1ef9250cc/update-config-json.js#L2 1 | const fs = require('fs') > 2 | const { exec } = require('child_process') 3 | const prompt = require('prompt') 4 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.384
4 findings[Reject — re-review on republish] (prior reject: AI (install-scripts): Postinstall runs a script explicitly named to steal secrets via child_process; malicious by design across all versions.) Script: node ./scripts/reveal-secrets-on-install.js
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/7f0db0c27d123705348650a7334bf2a3d465a6ad/scripts/reveal-secrets-on-install.js#L5 3 | const fs = require('fs') 4 | const path = require('path') > 5 | const { spawnSync } = require('child_process') 6 | 7 | const pkgRoot = path.resolve(__dirname, '..')
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/7f0db0c27d123705348650a7334bf2a3d465a6ad/update-config-json.js#L2 1 | const fs = require('fs') > 2 | const { exec } = require('child_process') 3 | const prompt = require('prompt') 4 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.383
4 findings[Reject — re-review on republish] (prior reject: AI (install-scripts): Postinstall runs a script explicitly named to steal secrets via child_process; malicious by design across all versions.) Script: node ./scripts/reveal-secrets-on-install.js
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/eaed3bcbf822fba08ffaab2ce48a69812ef6d95d/scripts/reveal-secrets-on-install.js#L5 3 | const fs = require('fs') 4 | const path = require('path') > 5 | const { spawnSync } = require('child_process') 6 | 7 | const pkgRoot = path.resolve(__dirname, '..')
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/eaed3bcbf822fba08ffaab2ce48a69812ef6d95d/update-config-json.js#L2 1 | const fs = require('fs') > 2 | const { exec } = require('child_process') 3 | const prompt = require('prompt') 4 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.382
4 findings[Reject — re-review on republish] (prior reject: AI (install-scripts): Postinstall runs a script explicitly named to steal secrets via child_process; malicious by design across all versions.) Script: node ./scripts/reveal-secrets-on-install.js
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/2fe4dab132aa119bcf04e3e3a304f1ea90f71c5e/scripts/reveal-secrets-on-install.js#L5 3 | const fs = require('fs') 4 | const path = require('path') > 5 | const { spawnSync } = require('child_process') 6 | 7 | const pkgRoot = path.resolve(__dirname, '..')
[Reject — re-review on republish] (prior reject: AI (semgrep): child_process used in the malicious reveal-secrets-on-install.js; generalizes to all versions of this package.) child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/2fe4dab132aa119bcf04e3e3a304f1ea90f71c5e/update-config-json.js#L2 1 | const fs = require('fs') > 2 | const { exec } = require('child_process') 3 | const prompt = require('prompt') 4 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.381
4 findings[Always reject] Script: node ./scripts/reveal-secrets-on-install.js
[Always reject] child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/2aa8fe18029ad3faadd39a9981dba3fca72da045/scripts/reveal-secrets-on-install.js#L5 3 | const fs = require('fs') 4 | const path = require('path') > 5 | const { spawnSync } = require('child_process') 6 | 7 | const pkgRoot = path.resolve(__dirname, '..')
[Always reject] child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/2aa8fe18029ad3faadd39a9981dba3fca72da045/update-config-json.js#L2 1 | const fs = require('fs') > 2 | const { exec } = require('child_process') 3 | const prompt = require('prompt') 4 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.380
4 findings[Always reject] Script: node ./scripts/reveal-secrets-on-install.js
[Always reject] child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/57df378fa144ab45c3fa4c3695c1b0734cc1dcbb/scripts/reveal-secrets-on-install.js#L5 3 | const fs = require('fs') 4 | const path = require('path') > 5 | const { spawnSync } = require('child_process') 6 | 7 | const pkgRoot = path.resolve(__dirname, '..')
[Always reject] child_process imported — can execute arbitrary system commands Source: https://github.com/icgio/clients-config/blob/57df378fa144ab45c3fa4c3695c1b0734cc1dcbb/update-config-json.js#L2 1 | const fs = require('fs') > 2 | const { exec } = require('child_process') 3 | const prompt = require('prompt') 4 |
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.