← Home

@spinajs/fs

npm Repository Homepage

wrapper for file operations

51
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

gben-spina

Keywords

dicontainerspinajsdi

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:etc-passwd-access AI (semgrep): Match is in a comment describing sandbox path-traversal check, not executable code. ai
phantom-deps phantom-dep:exiftool-vendored AI (phantom-deps): Replaces removed exiftool dep for same file-metadata functionality; likely used via dynamic import. ai
provenance no-provenance AI (provenance): Long-established package with consistent publish history; lack of provenance is a known stable condition. ai
publish-pattern rapid-publish AI (publish-pattern): spinajs monorepo publishes all packages simultaneously; rapid publish is expected behavior across 400+ versions. ai
dependencies unvetted-dep:exiftool AI (dependencies): exiftool 0.0.3 is a stable declared dependency present across prior approved versions of this package. ai
publish-pattern dormant-publish AI (publish-pattern): Publisher has 206 approved packages with clean history; dormancy pattern is not indicative of takeover for this monorepo. ai
typosquat typosquat.levenshtein:qs AI (typosquat): Scoped @spinajs package; not a typosquat of 'qs'. Levenshtein match is spurious for scoped names. ai
phantom-deps phantom-dep:exiftool AI (phantom-deps): exiftool is a declared runtime dependency; phantom-dep false positive for this package. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Scoped @spinajs package; not a typosquat of 'pg'. Levenshtein match is spurious for scoped names. ai
phantom-deps phantom-dep:lodash AI (phantom-deps): lodash is a declared runtime dependency; phantom-dep false positive for this package. ai

Versions (showing 51 of 197)

View all versions
Version Deps Published
2.0.482 13 / 5
2.0.470 10 / 4
2.0.468 10 / 4
2.0.466 10 / 4
2.0.465 10 / 4
2.0.464 10 / 4
2.0.463 10 / 4
2.0.462 10 / 4
2.0.461 10 / 4
2.0.460 10 / 4
2.0.458 10 / 4
2.0.457 10 / 4
2.0.456 10 / 4
2.0.455 10 / 4
2.0.453 10 / 4
2.0.452 10 / 4
2.0.451 10 / 4
2.0.450 10 / 4
2.0.449 10 / 4
2.0.448 10 / 4
2.0.447 10 / 4
2.0.446 10 / 4
2.0.445 10 / 4
2.0.444 10 / 4
2.0.441 10 / 4
2.0.439 10 / 4
2.0.436 10 / 4
2.0.435 10 / 4
2.0.434 10 / 4
2.0.432 10 / 4
2.0.430 10 / 4
2.0.429 10 / 4
2.0.428 10 / 4
2.0.427 10 / 4
2.0.426 10 / 4
2.0.425 10 / 4
2.0.424 10 / 4
2.0.423 10 / 4
2.0.422 10 / 4
2.0.421 10 / 4
2.0.420 10 / 4
2.0.419 10 / 4
2.0.417 10 / 4
2.0.415 10 / 4
2.0.414 10 / 4
2.0.413 10 / 4
2.0.412 10 / 4
2.0.411 10 / 4
2.0.409 10 / 4
2.0.408 10 / 4
2.0.406 10 / 4

v2.0.482

3 findings
HIGH etc-passwd-access: lib/cjs/local-provider.js:489 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/spinajs/exceptions/blob/002dc553b0ffffd72193d0121ac425a4083bc9ee/lib/cjs/local-provider.js#L489 487 | } 488 | // join normalizes `..` segments - verify the result still lives inside basePath > 489 | // so relative paths cannot escape the sandbox ( eg. ../../etc/passwd ) 490 | const joined = (0, path_1.join)(base, path); 491 | const rel = (0, path_1.relative)(base, joined);

HIGH etc-passwd-access: lib/mjs/local-provider.js:483 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/spinajs/exceptions/blob/002dc553b0ffffd72193d0121ac425a4083bc9ee/lib/mjs/local-provider.js#L483 481 | } 482 | // join normalizes `..` segments - verify the result still lives inside basePath > 483 | // so relative paths cannot escape the sandbox ( eg. ../../etc/passwd ) 484 | const joined = join(base, path); 485 | const rel = relative(base, joined);

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.