@remnic/cli
CLI for Remnic memory — init, query, doctor, daemon management
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is used to pass environment to a child process in a CLI launcher — standard pattern, not exfiltration. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @remnic/cli is unrelated to joi; Levenshtein match is a false positive. | ai |
v1.0.3
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/7bb36ff7ad6b8c93126dbabd059c46ead6dfa960/bin/engram.cjs#L29 27 | { 28 | stdio: "inherit", > 29 | env: { ...process.env, REMNIC_CLI_BIN: "1", ENGRAM_CLI_BIN: "1", ...colorEnv }, 30 | }, 31 | );
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/7bb36ff7ad6b8c93126dbabd059c46ead6dfa960/bin/engram.cjs#L44 42 | { 43 | stdio: "inherit", > 44 | env: { ...process.env, REMNIC_CLI_BIN: "1", ENGRAM_CLI_BIN: "1", ...colorEnv }, 45 | }, 46 | );
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/7bb36ff7ad6b8c93126dbabd059c46ead6dfa960/bin/remnic.cjs#L24 22 | execFileSync(process.execPath, [distEntry, ...process.argv.slice(2)], { 23 | stdio: "inherit", > 24 | env: { ...process.env, REMNIC_CLI_BIN: "1", ...colorEnv }, 25 | }); 26 | } else {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/7bb36ff7ad6b8c93126dbabd059c46ead6dfa960/bin/remnic.cjs#L34 32 | execFileSync(tsxCmd, [srcEntry, ...process.argv.slice(2)], { 33 | stdio: "inherit", > 34 | env: { ...process.env, REMNIC_CLI_BIN: "1", ...colorEnv }, 35 | }); 36 | }
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.0
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/22a2f1449c56c15d77662aaac85e942880c5d494/bin/engram.cjs#L29 27 | { 28 | stdio: "inherit", > 29 | env: { ...process.env, REMNIC_CLI_BIN: "1", ENGRAM_CLI_BIN: "1", ...colorEnv }, 30 | }, 31 | );
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/22a2f1449c56c15d77662aaac85e942880c5d494/bin/engram.cjs#L44 42 | { 43 | stdio: "inherit", > 44 | env: { ...process.env, REMNIC_CLI_BIN: "1", ENGRAM_CLI_BIN: "1", ...colorEnv }, 45 | }, 46 | );
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/22a2f1449c56c15d77662aaac85e942880c5d494/bin/remnic.cjs#L24 22 | execFileSync(process.execPath, [distEntry, ...process.argv.slice(2)], { 23 | stdio: "inherit", > 24 | env: { ...process.env, REMNIC_CLI_BIN: "1", ...colorEnv }, 25 | }); 26 | } else {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/joshuaswarren/remnic/blob/22a2f1449c56c15d77662aaac85e942880c5d494/bin/remnic.cjs#L34 32 | execFileSync(tsxCmd, [srcEntry, ...process.argv.slice(2)], { 33 | stdio: "inherit", > 34 | env: { ...process.env, REMNIC_CLI_BIN: "1", ...colorEnv }, 35 | }); 36 | }
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.