@push.rocks/smartdns
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:elliptic | AI (dependencies): elliptic is a well-known crypto library used for DNSSEC EdDSA support. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): In-house Rust DNS binaries built via tsrust toolchain, spawned locally, not fetched externally. | ai | |
| source-diff | obfuscated-file:dist_ts_server/classes.rustdnsbridge.js | AI (source-diff): Readable TS-compiled JS bridging local Rust binaries; long lines are bundler output, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist_ts_client/classes.rustdnsclientbridge.js | AI (source-diff): Same pattern — clean bridge code for rustdns-client binary, not obfuscated. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding used for DNSSEC EdDSA private key parsing — legitimate cryptographic operation in a DNS library. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding used to parse DNSKEY record public key data — standard DNS/DNSSEC protocol handling. | ai | |
| phantom-deps | phantom-dep:@types/elliptic | AI (phantom-deps): @types packages are type-only and loaded by convention; not a real phantom dep concern. | ai | |
| phantom-deps | phantom-dep:@types/dns-packet | AI (phantom-deps): @types packages are type-only and loaded by convention; not a real phantom dep concern. | ai |
Versions (showing 22 of 22)
| Version | Deps | Published |
|---|---|---|
| 8.0.1 | 7 / 8 | |
| 8.0.0 | 7 / 8 | |
| 7.12.1 | 7 / 8 | |
| 7.12.0 | 7 / 8 | |
| 7.11.3 | 7 / 8 | |
| 7.11.2 | 7 / 8 | |
| 7.11.1 | 7 / 8 | |
| 7.11.0 | 7 / 8 | |
| 7.10.1 | 7 / 8 | |
| 7.10.0 | 7 / 8 | |
| 7.9.3 | 7 / 8 | |
| 7.9.2 | 7 / 8 | |
| 7.9.1 | 7 / 8 | |
| 7.9.0 | 7 / 7 | |
| 7.8.1 | 7 / 7 | |
| 7.8.0 | 10 / 5 | |
| 7.5.0 | 11 / 4 | |
| 7.4.7 | 11 / 4 | |
| 7.4.6 | 11 / 4 | |
| 7.4.3 | 11 / 4 | |
| 7.4.0 | 11 / 4 | |
| 7.0.2 | 11 / 4 |
v8.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.12.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.12.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.11.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.11.2
4 findingsPackage contains compiled binaries that could be backdoors: • dist_rust/rustdns_linux_amd64 • dist_rust/rustdns_linux_arm64 • dist_rust/rustdns-client_linux_amd64 • dist_rust/rustdns-client_linux_arm64
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.9.2
2 findingsPackage contains compiled binaries that could be backdoors: • dist_rust/rustdns_linux_amd64 • dist_rust/rustdns_linux_arm64 • dist_rust/rustdns-client_linux_amd64 • dist_rust/rustdns-client_linux_arm64
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.9.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist_rust/rustdns_linux_amd64 • dist_rust/rustdns_linux_arm64 • dist_rust/rustdns-client_linux_amd64 • dist_rust/rustdns-client_linux_arm64
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.9.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist_rust/rustdns_linux_amd64 • dist_rust/rustdns_linux_arm64 • dist_rust/rustdns-client_linux_amd64 • dist_rust/rustdns-client_linux_arm64
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.8.1
2 findingsPackage contains compiled binaries that could be backdoors: • dist_rust/rustdns_linux_amd64 • dist_rust/rustdns_linux_arm64 • dist_rust/rustdns-client_linux_amd64 • dist_rust/rustdns-client_linux_arm64
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.8.0
2 findingsPackage contains compiled binaries that could be backdoors: • dist_rust/rustdns_linux_amd64 • dist_rust/rustdns_linux_arm64 • dist_rust/rustdns-client_linux_amd64 • dist_rust/rustdns-client_linux_arm64
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.4.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.4.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.