@prisma-next/cli-telemetry
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): IPC send to own detached subprocess for telemetry, not exfil to external host. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Adds official @vercel/detect-agent package, no install-time code execution. | ai | |
| provenance | missing-githead | AI (provenance): Monorepo CI pipeline; SLSA provenance attestation present compensates for missing gitHead field. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Monorepo with 120 versions; rapid successive publishes are expected for coordinated version bumps across packages. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 0.16.0 | 6 / 7 | |
| 0.15.0 | 6 / 7 | |
| 0.14.0 | 5 / 7 | |
| 0.13.0 | 5 / 7 | |
| 0.12.0 | 5 / 7 | |
| 0.11.0 | 5 / 7 | |
| 0.10.0 | 2 / 7 |
v0.16.0
3 findingsEntire process.env captured and flowed into a network request or child-process argv — likely credential harvesting 109 | stdio: ['pipe', 'ignore', 'ignore', 'ipc'], 110 | }); > 111 | child.send(payload, (err) => { 112 | if (err !== null && process.env['PRISMA_NEXT_DEBUG'] === '1') { 113 | process.stderr.write(`[cli-telemetry] parent send error: ${String(err)}\n`);
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v0.15.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.