@schematize/serverless-function-test
Schematize Serverless Function Tester Library for testing serverless functions locally
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Snapshot of process.env for test isolation/restore; expected pattern in a serverless function test harness. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Enumerating keys to clean up env after test run; part of the same isolation pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Pass-through decode of Lambda response body; not hiding a payload. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 0.6.7 | 1 / 0 | |
| 0.6.6 | 1 / 0 | |
| 0.6.5 | 1 / 0 | |
| 0.6.4 | 1 / 0 | |
| 0.6.3 | 1 / 0 |
v0.6.7
2 findingsSpreading entire process.env into an object — may capture all secrets 239 | env, 240 | }) { > 241 | let envSnapshot = { ...process.env }; 242 | let dotenvPath = join(functionDir, `.env`); 243 | try {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.6
2 findingsSpreading entire process.env into an object — may capture all secrets 239 | env, 240 | }) { > 241 | let envSnapshot = { ...process.env }; 242 | let dotenvPath = join(functionDir, `.env`); 243 | try {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.5
2 findingsSpreading entire process.env into an object — may capture all secrets 239 | env, 240 | }) { > 241 | let envSnapshot = { ...process.env }; 242 | let dotenvPath = join(functionDir, `.env`); 243 | try {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.4
2 findingsSpreading entire process.env into an object — may capture all secrets 239 | env, 240 | }) { > 241 | let envSnapshot = { ...process.env }; 242 | let dotenvPath = join(functionDir, `.env`); 243 | try {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.3
2 findingsSpreading entire process.env into an object — may capture all secrets 233 | env, 234 | }) { > 235 | let envSnapshot = { ...process.env }; 236 | let dotenvPath = join(functionDir, `.env`); 237 | try {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.