@rickydata/security-kernel
Security kernel for Rickydata - TPM sealing, encryption, and sign-to-derive key derivation
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is used to pass process.env to execFileSync for TPM CLI tools — standard and expected pattern for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used to invoke TPM2 tools (tpm2-tools CLI); core functionality of a TPM sealing library. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is part of sign-to-derive key derivation using SHA-256 hashing of ECDSA signature components — legitimate crypto use. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is used for encrypted payload and IV handling in the encryption module — standard crypto pattern. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 1.1.5 | 0 / 3 | |
| 1.1.4 | 0 / 3 | |
| 1.1.3 | 0 / 3 | |
| 1.1.2 | 0 / 3 | |
| 1.1.1 | 0 / 3 | |
| 1.1.0 | 0 / 3 | |
| 1.0.8 | 0 / 3 | |
| 1.0.7 | 0 / 3 | |
| 1.0.6 | 0 / 3 | |
| 1.0.5 | 0 / 3 | |
| 1.0.4 | 0 / 3 | |
| 1.0.3 | 0 / 3 | |
| 1.0.2 | 0 / 3 | |
| 1.0.1 | 0 / 3 | |
| 1.0.0 | 0 / 3 |
v1.1.5
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/rickycambrian/rickydata_security_kernel/blob/007e044f0b4af99800260f012897d1e300c4a0b4/dist-cjs/tpm-sealer.js#L136 134 | return (0, child_process_1.execFileSync)(command, args, { 135 | input: options?.input, > 136 | env: { 137 | ...process.env, 138 | ...(options?.tcti ? { TPM2TOOLS_TCTI: options.tcti } : {}),
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/rickycambrian/rickydata_security_kernel/blob/007e044f0b4af99800260f012897d1e300c4a0b4/src/tpm-sealer.ts#L107 105 | return execFileSync(command, args, { 106 | input: options?.input, > 107 | env: { 108 | ...process.env, 109 | ...(options?.tcti ? { TPM2TOOLS_TCTI: options.tcti } : {}),
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.