@specverse/engines
SpecVerse toolchain — parser, inference, realize, generators, AI, registry, bundles
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): Used in example/validation scripts, not runtime library code. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Template engine renderer compiling user-defined view bodies — expected pattern for this toolchain. | ai | |
| provenance | no-provenance | AI (provenance): No provenance is common (~88% of npm); no other risk signals elevate this. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Occurs in a test-deployments script; spreading process.env for child process inheritance is standard test tooling. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Parses self-generated embedded resource object; comment confirms controlled input. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): zod is a declared runtime dependency in package.json; phantom-dep heuristic is a false positive here. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Localhost (127.0.0.1) proxy target for dev server; not an exfiltration or C2 endpoint. | ai |
Versions (showing 43 of 43)
| Version | Deps | Published |
|---|---|---|
| 6.53.1 | 21 / 1 | |
| 6.2.1 | 18 / 3 | |
| 6.0.18 | 16 / 3 | |
| 6.0.2 | 15 / 3 | |
| 4.3.5 | 9 / 3 | |
| 4.3.4 | 9 / 3 | |
| 4.3.3 | 9 / 3 | |
| 4.3.2 | 9 / 3 | |
| 4.3.1 | 9 / 3 | |
| 4.3.0 | 9 / 3 | |
| 4.2.2 | 9 / 3 | |
| 4.2.1 | 8 / 3 | |
| 4.2.0 | 8 / 3 | |
| 4.1.30 | 8 / 3 | |
| 4.1.28 | 8 / 3 | |
| 4.1.27 | 8 / 3 | |
| 4.1.26 | 8 / 3 | |
| 4.1.25 | 8 / 3 | |
| 4.1.24 | 8 / 3 | |
| 4.1.23 | 8 / 3 | |
| 4.1.22 | 8 / 3 | |
| 4.1.21 | 8 / 3 | |
| 4.1.20 | 8 / 3 | |
| 4.1.19 | 8 / 3 | |
| 4.1.18 | 8 / 3 | |
| 4.1.17 | 8 / 3 | |
| 4.1.16 | 8 / 3 | |
| 4.1.15 | 8 / 3 | |
| 4.1.14 | 8 / 3 | |
| 4.1.13 | 8 / 3 | |
| 4.1.12 | 8 / 3 | |
| 4.1.11 | 8 / 3 | |
| 4.1.10 | 8 / 3 | |
| 4.1.9 | 8 / 3 | |
| 4.1.8 | 8 / 3 | |
| 4.1.7 | 8 / 3 | |
| 4.1.6 | 8 / 3 | |
| 4.1.5 | 8 / 2 | |
| 4.1.4 | 8 / 2 | |
| 4.1.3 | 8 / 2 | |
| 4.1.2 | 8 / 2 | |
| 4.1.1 | 4 / 2 | |
| 4.1.0 | 4 / 2 |
v6.53.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.5
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.4
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.3
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.2
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.1
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.3.0
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.2.2
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.2.1
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.2.0
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.30
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.28
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.27
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.26
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.25
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.24
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.23
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.22
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.21
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.20
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.19
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.18
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.17
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.16
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.15
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.14
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.13
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.12
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.11
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.10
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.9
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.8
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.7
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.6
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.5
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.4
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.3
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.2
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.1
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v4.1.0
2 findingsSpreading entire process.env into an object — may capture all secrets 30 | cwd: rootDir, 31 | stdio: ['pipe', 'pipe', 'pipe'], > 32 | env: { ...process.env, NODE_ENV: 'test' } 33 | }); 34 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.