@lmstudio/lms-isomorphic
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): process.env is spread into a tput subprocess call to preserve the terminal environment — a standard, benign pattern with no exfiltration risk. Stable false positive for this package. | ai |
v0.4.6
3 findingsSpreading entire process.env into an object — may capture all secrets 91 | try { 92 | // `tput` requires the `TERM` environment variable to be set. > 93 | const columns = exec("tput", ["cols"], { env: { TERM: "dumb", ...process.env } }); 94 | const rows = exec("tput", ["lines"], { env: { TERM: "dumb", ...process.env } }); 95 |
Spreading entire process.env into an object — may capture all secrets 92 | // `tput` requires the `TERM` environment variable to be set. 93 | const columns = exec("tput", ["cols"], { env: { TERM: "dumb", ...process.env } }); > 94 | const rows = exec("tput", ["lines"], { env: { TERM: "dumb", ...process.env } }); 95 | 96 | if (columns && rows) {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.