@nacho-iot/js-tools
Build, run, and versioning tooling for TypeScript projects and monorepos
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Intentional pattern for subprocess execution helper; merging process.env with caller overrides is the documented use case. | ai | |
| phantom-deps | phantom-dep:type-fest | AI (phantom-deps): Dev/doc tooling dependency referenced in config files only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@microsoft/tsdoc | AI (phantom-deps): Doc tooling dependency referenced in config files only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:typedoc-github-theme | AI (phantom-deps): Doc tooling dependency referenced in config files only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@typescript/native-preview | AI (phantom-deps): Build tooling dependency referenced in config files only; stable false positive for this package. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 0.1.7 | 11 / 2 | |
| 0.1.6 | 11 / 2 | |
| 0.1.5 | 11 / 2 | |
| 0.1.4 | 11 / 2 | |
| 0.1.3 | 11 / 2 | |
| 0.1.2 | 11 / 2 | |
| 0.1.1 | 11 / 2 | |
| 0.1.0 | 11 / 2 |
v0.1.7
2 findingsSpreading entire process.env into an object — may capture all secrets 26 | } 27 | if (env !== undefined) { > 28 | spawnOptions.env = { ...process.env, ...env }; 29 | } 30 | if (cwd !== undefined) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.6
2 findingsSpreading entire process.env into an object — may capture all secrets 26 | } 27 | if (env !== undefined) { > 28 | spawnOptions.env = { ...process.env, ...env }; 29 | } 30 | if (cwd !== undefined) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.5
2 findingsSpreading entire process.env into an object — may capture all secrets 26 | } 27 | if (env !== undefined) { > 28 | spawnOptions.env = { ...process.env, ...env }; 29 | } 30 | if (cwd !== undefined) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.4
2 findingsSpreading entire process.env into an object — may capture all secrets 26 | } 27 | if (env !== undefined) { > 28 | spawnOptions.env = { ...process.env, ...env }; 29 | } 30 | if (cwd !== undefined) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.3
2 findingsSpreading entire process.env into an object — may capture all secrets 26 | } 27 | if (env !== undefined) { > 28 | spawnOptions.env = { ...process.env, ...env }; 29 | } 30 | if (cwd !== undefined) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.2
2 findingsSpreading entire process.env into an object — may capture all secrets 26 | } 27 | if (env !== undefined) { > 28 | spawnOptions.env = { ...process.env, ...env }; 29 | } 30 | if (cwd !== undefined) {
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.1
2 findingsSpreading entire process.env into an object — may capture all secrets 21 | } 22 | if (env !== undefined) { > 23 | options.env = { ...process.env, ...env }; 24 | } 25 |
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.0
2 findingsSpreading entire process.env into an object — may capture all secrets 21 | } 22 | if (env !== undefined) { > 23 | options.env = { ...process.env, ...env }; 24 | } 25 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.