← Home

@monoes/monograph

npm
4
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

nokhodian

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:tree-sitter-vue AI (dependencies): Legitimate tree-sitter grammar consistent with package purpose. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Localhost test server, not external exfil. ai
semgrep semgrep:dynamic-require AI (semgrep): Loads prebuilt native tree-sitter binding by platform path. ai
semgrep semgrep:new-function-constructor AI (semgrep): Lazy dynamic import of pdf-parse, not eval of untrusted input. ai
semgrep semgrep:etc-passwd-access AI (semgrep): Test asserting the path is rejected, not actual access. ai
semgrep semgrep:env-spread AI (semgrep): env spread used for git subprocess with GIT_TERMINAL_PROMPT override, not exfil. ai
phantom-deps phantom-dep:graphology-metrics AI (phantom-deps): Transitive dependency of graphology ecosystem; declared and used correctly. ai
phantom-deps phantom-dep:graphology-traversal AI (phantom-deps): Transitive dependency of graphology ecosystem; declared and used correctly. ai
phantom-deps phantom-dep:graphology-types AI (phantom-deps): Transitive dependency of graphology ecosystem; declared and used correctly. ai

Versions (showing 4 of 4)

Version Deps Published
1.2.2 24 / 6
1.2.0 24 / 6
1.1.0 14 / 4
1.0.0 14 / 4

v1.2.2

5 findings
HIGH etc-passwd-access: __tests__/security/safe-fetch.test.ts:30 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 28 | describe('validateUrl', () => { 29 | it('rejects non-http schemes', () => { > 30 | expect(() => validateUrl('file:///etc/passwd')).toThrow('Unsupported scheme'); 31 | expect(() => validateUrl('ftp://example.com')).toThrow('Unsupported scheme'); 32 | });

HIGH etc-passwd-access: src/__tests__/ingest/git-clone.test.ts:28 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 26 | 27 | it('blocks file:// scheme', () => { > 28 | expect(() => validateGitUrl('file:///etc/passwd')).toThrow(); 29 | }); 30 |

HIGH etc-passwd-access: src/__tests__/security/safe-fetch.test.ts:30 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 28 | describe('validateUrl', () => { 29 | it('throws on file: scheme', () => { > 30 | expect(() => validateUrl('file:///etc/passwd')).toThrow(/Unsupported scheme/); 31 | }); 32 | it('throws on ftp: scheme', () => {

HIGH env-spread: src/ingest/git-clone.ts:219 semgrep

Spreading entire process.env into an object — may capture all secrets 217 | cwd, 218 | stdio: ['ignore', 'pipe', 'pipe'], > 219 | env: { 220 | ...process.env, 221 | GIT_TERMINAL_PROMPT: '0',

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.