@sqldoc/sqldoc
Global CLI shim for sqldoc -- finds .sqldoc/ and delegates to project-local @sqldoc/cli
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): CLI shim legitimately passes process.env to child process; not credential theft. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 0.2.9 | 2 / 4 | |
| 0.2.8 | 2 / 4 | |
| 0.2.7 | 2 / 4 | |
| 0.2.6 | 2 / 4 | |
| 0.2.5 | 2 / 4 | |
| 0.2.4 | 2 / 4 | |
| 0.2.3 | 2 / 4 | |
| 0.2.2 | 2 / 4 | |
| 0.2.1 | 2 / 4 | |
| 0.2.0 | 2 / 4 | |
| 0.1.3 | 2 / 4 | |
| 0.1.2 | 2 / 4 | |
| 0.1.1 | 2 / 4 | |
| 0.1.0 | 2 / 4 | |
| 0.0.10 | 1 / 3 | |
| 0.0.9 | 1 / 3 | |
| 0.0.8 | 1 / 3 | |
| 0.0.7 | 1 / 3 | |
| 0.0.6 | 1 / 3 | |
| 0.0.5 | 1 / 3 | |
| 0.0.4 | 1 / 3 | |
| 0.0.3 | 1 / 3 | |
| 0.0.2 | 1 / 3 | |
| 0.0.1 | 1 / 3 |
v0.2.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.10
7 findingsSpreading entire process.env into an object — may capture all secrets 25 | })() 26 | > 27 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 28 | 29 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 35 | })() 36 | > 37 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 38 | 39 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 27 | })() 28 | > 29 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 30 | 31 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.9
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.8
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.7
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.6
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.5
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.4
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.3
7 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 30 | try { 31 | const output = execSync(`"${process.execPath}" "${localCli}" --help-json`, { > 32 | env: { 33 | ...process.env, 34 | NODE_PATH: path.join(sqldocDir, 'node_modules'),
Spreading entire process.env into an object — may capture all secrets 108 | cwd: sqldocDir, 109 | stdio: 'inherit', > 110 | env: { ...process.env, ...pm.env }, 111 | }) 112 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.2
6 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 58 | cwd: sqldocDir, 59 | stdio: 'inherit', > 60 | env: { ...process.env, ...pm.env }, 61 | }) 62 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
6 findingsSpreading entire process.env into an object — may capture all secrets 28 | })() 29 | > 30 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 31 | 32 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 38 | })() 39 | > 40 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 41 | 42 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 30 | })() 31 | > 32 | const env = isCompiledBinary() ? { ...process.env, BUN_BE_BUN: '1' } : process.env 33 | 34 | if (isCompiledBinary()) {
Spreading entire process.env into an object — may capture all secrets 26 | stdio: 'inherit', 27 | cwd: process.cwd(), > 28 | env: { 29 | ...process.env, 30 | SQLDOC_PROJECT_ROOT: projectRoot,
Spreading entire process.env into an object — may capture all secrets 58 | cwd: sqldocDir, 59 | stdio: 'inherit', > 60 | env: { ...process.env, ...pm.env }, 61 | }) 62 | } catch {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.