@opensip-tools/cli

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/opensip-ai/opensip-tools/blob/aec9240c2f5285e400999bee967729c5c2dab2a6/src/__tests__/e2e.test.ts#L28 26 | encoding: 'utf-8', 27 | timeout: 60_000, > 28 | env: { ...process.env, NO_COLOR: '1' }, 29 | }); 30 | return { stdout, exitCode: 0 };

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/opensip-ai/opensip-tools/blob/aec9240c2f5285e400999bee967729c5c2dab2a6/src/__tests__/e2e.test.ts#L43 41 | encoding: 'utf-8', 42 | timeout: 60_000, > 43 | env: { ...process.env, NO_COLOR: '1' }, 44 | }); 45 | return { stdout, exitCode: 0 };

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/opensip-ai/opensip-tools/blob/aec9240c2f5285e400999bee967729c5c2dab2a6/src/__tests__/error-handling.test.ts#L82 80 | 81 | it('detects EACCES permission denied errors', () => { > 82 | const err = new Error('EACCES: permission denied, open /etc/shadow'); 83 | const suggestion = getErrorSuggestion(err); 84 | expect(suggestion).not.toBeNull();

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/opensip-ai/opensip-tools/blob/aec9240c2f5285e400999bee967729c5c2dab2a6/src/__tests__/persistence.test.ts#L61 59 | 60 | it('strips dots (used in path traversal)', () => { > 61 | // ../../etc/passwd -> .. collapsed first, then individual special chars replaced 62 | const result = storeModule.sanitizeForFilename('../../etc/passwd'); 63 | expect(result).not.toContain('/');

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/opensip-ai/opensip-tools/blob/aec9240c2f5285e400999bee967729c5c2dab2a6/src/__tests__/persistence.test.ts#L62 60 | it('strips dots (used in path traversal)', () => { 61 | // ../../etc/passwd -> .. collapsed first, then individual special chars replaced > 62 | const result = storeModule.sanitizeForFilename('../../etc/passwd'); 63 | expect(result).not.toContain('/'); 64 | expect(result).not.toContain('.');

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/opensip-ai/opensip-tools/blob/aec9240c2f5285e400999bee967729c5c2dab2a6/src/__tests__/persistence.test.ts#L170 168 | describe('path traversal prevention', () => { 169 | it('saveSession uses basename to prevent directory traversal in recipe names', () => { > 170 | const session = makeSession({ recipe: '../../etc/passwd' }); 171 | const filepath = storeModule.saveSession(session); 172 | // The filepath should stay within the sessions directory

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.