@infernetprotocol/engine
Inference engine abstraction for Infernet — pluggable backends (Mojo+MAX, in-process stub) over a stable async-iterator API.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Intentional pattern: merging process.env with user-supplied env vars when spawning a child process is idiomatic and expected for this engine abstraction library. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 0.1.45 | 0 / 0 | |
| 0.1.41 | 0 / 0 | |
| 0.1.40 | 0 / 0 | |
| 0.1.39 | 0 / 0 | |
| 0.1.38 | 0 / 0 | |
| 0.1.37 | 0 / 0 | |
| 0.1.36 | 0 / 0 | |
| 0.1.35 | 0 / 0 | |
| 0.1.34 | 0 / 0 | |
| 0.1.33 | 0 / 0 | |
| 0.1.32 | 0 / 0 | |
| 0.1.31 | 0 / 0 | |
| 0.1.30 | 0 / 0 | |
| 0.1.29 | 0 / 0 | |
| 0.1.28 | 0 / 0 | |
| 0.1.27 | 0 / 0 | |
| 0.1.26 | 0 / 0 | |
| 0.1.25 | 0 / 0 | |
| 0.1.22 | 0 / 0 |
v0.1.45
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.41
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.40
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.39
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.38
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.37
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.36
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.35
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.34
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.33
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.32
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.31
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.30
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.29
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.28
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.27
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.26
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.25
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.22
2 findingsSpreading entire process.env into an object — may capture all secrets 39 | this.child = spawn(this.binary, this.args, { 40 | stdio: ["pipe", "pipe", "inherit"], > 41 | env: { ...process.env, ...this.env }, 42 | cwd: this.cwd 43 | });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.