← Home

@inkeep/agents-manage-mcp

npm Repository Homepage
37
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

abraham-inkeepnick-inkeeprobert-inkeepsarah-inkeepandrew-inkeepomar-inkeepmiles-inkeep

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:silent-process-exec AI (semgrep): Dev-only build script (fetch-openapi.mjs), spawns local pnpm dev server, not malicious. ai
semgrep semgrep:silent-process-exec-var AI (semgrep): Same dev-only script; benign local pnpm invocation. ai
phantom-deps phantom-dep:bun AI (phantom-deps): bun used as build/runtime tool via config, not direct import. ai

Versions (showing 37 of 37)

Version Deps Published
0.48.5 4 / 12
0.48.4 4 / 12
0.48.3 4 / 12
0.48.2 4 / 12
0.48.1 4 / 12
0.48.0 4 / 12
0.47.5 4 / 12
0.47.4 4 / 12
0.47.3 4 / 12
0.47.2 4 / 12
0.47.1 4 / 12
0.47.0 4 / 12
0.46.1 4 / 12
0.46.0 4 / 12
0.45.3 4 / 12
0.45.2 4 / 12
0.45.1 4 / 12
0.45.0 4 / 12
0.44.0 4 / 12
0.43.0 4 / 12
0.42.0 4 / 12
0.41.2 4 / 13
0.41.1 4 / 13
0.41.0 4 / 13
0.40.0 4 / 13
0.39.5 4 / 13
0.39.4 4 / 13
0.39.3 4 / 13
0.39.2 4 / 13
0.39.1 4 / 13
0.39.0 4 / 13
0.38.3 4 / 13
0.38.2 4 / 13
0.38.1 4 / 13
0.38.0 5 / 11
0.37.2 5 / 11
0.37.1 5 / 11

v0.48.5

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.48.4

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.48.3

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.48.2

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.48.1

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.48.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.5

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.4

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.3

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.2

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.1

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.47.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.46.1

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.46.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.45.3

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.45.2

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.45.1

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.45.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.44.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.43.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.42.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.41.2

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.41.1

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.41.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.40.0

3 findings
HIGH silent-process-exec: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

HIGH silent-process-exec-var: scripts/fetch-openapi.mjs:49 semgrep

Silent detached process — runs invisibly in the background (reverse shells, miners) 47 | 48 | return new Promise((resolve, reject) => { > 49 | const proc = spawn('pnpm', ['--filter', '@inkeep/agents-manage-api', 'dev'], { 50 | cwd: rootDir, 51 | stdio: 'ignore',

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.39.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.39.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.39.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.39.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.39.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.39.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.38.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.38.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.38.1

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: abraham-inkeep → GitHub Actions (on 2025-12-12, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (abraham-inkeep) on 2025-12-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v0.38.0

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: abraham-inkeep → GitHub Actions (on 2025-12-11, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (abraham-inkeep) on 2025-12-11, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v0.37.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.37.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.