← Home

@opensip-tools/graph

npm Repository Homepage
21
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

opensip

Keywords

opensip-toolsstatic-analysiscode-qualitycall-graphdependency-graphcode-analysisarchitecture

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): env-spread is used to re-spawn the process with merged NODE_OPTIONS; standard pattern, not exfiltration. ai
phantom-deps phantom-dep:commander AI (phantom-deps): commander is declared in dependencies and used via CLI config; phantom-dep heuristic false positive for this package. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IP usage is in a test file using loopback address 127.0.0.1 to simulate network failure — not a real exfiltration risk. ai
phantom-deps phantom-dep:glob AI (phantom-deps): glob is explicitly declared as a runtime dependency in package.json; stable false positive for this package. ai

Versions (showing 21 of 21)

Version Deps Published
2.8.0 11 / 5
2.7.1 11 / 5
2.7.0 11 / 5
2.6.2 12 / 4
2.6.1 12 / 4
2.6.0 12 / 4
2.5.2 12 / 4
2.5.1 12 / 4
2.4.1 12 / 4
2.4.0 12 / 4
2.3.3 12 / 4
2.3.2 12 / 4
2.3.1 12 / 4
2.3.0 12 / 4
2.1.0 12 / 4
2.0.1 10 / 4
2.0.0 10 / 4
1.3.1 10 / 2
1.3.0 10 / 2
1.2.0 7 / 2
1.0.10 7 / 2

v2.8.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.7.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.6.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.1.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.1

2 findings
HIGH env-spread: src/cli/heap-preflight.ts:185 semgrep

Spreading entire process.env into an object — may capture all secrets 183 | 184 | const child = spawn(process.execPath, process.argv.slice(1), { > 185 | env: { 186 | ...process.env, 187 | NODE_OPTIONS: mergedNodeOptions,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.0.0

2 findings
HIGH env-spread: src/cli/heap-preflight.ts:185 semgrep

Spreading entire process.env into an object — may capture all secrets 183 | 184 | const child = spawn(process.execPath, process.argv.slice(1), { > 185 | env: { 186 | ...process.env, 187 | NODE_OPTIONS: mergedNodeOptions,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.