@theia/plugin-dev
Theia - Plugin Development Extension
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): Theia plugin-dev legitimately spawns hosted plugin instances as child processes; stable pattern across all versions. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawning hosted plugin instances is core functionality of this package; not a security concern. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Passing process.env to child plugin process is expected behavior for an IDE plugin host manager. | ai | |
| dependencies | unvetted-dep:@theia/core | AI (dependencies): Same-version sibling package from the eclipse-theia monorepo; not an independent risk. | ai | |
| dependencies | unvetted-dep:@theia/debug | AI (dependencies): Same-version sibling package from the eclipse-theia monorepo; not an independent risk. | ai | |
| dependencies | unvetted-dep:@theia/output | AI (dependencies): Same-version sibling package from the eclipse-theia monorepo; not an independent risk. | ai | |
| dependencies | unvetted-dep:@theia/workspace | AI (dependencies): Same-version sibling package from the eclipse-theia monorepo; not an independent risk. | ai | |
| dependencies | unvetted-dep:@theia/filesystem | AI (dependencies): Same-version sibling package from the eclipse-theia monorepo; not an independent risk. | ai | |
| dependencies | unvetted-dep:@theia/plugin-ext | AI (dependencies): Same-version sibling package from the eclipse-theia monorepo; not an independent risk. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 1.72.1 | 7 / 1 | |
| 1.72.0 | 7 / 1 | |
| 1.71.2 | 7 / 1 | |
| 1.70.2 | 7 / 1 | |
| 1.70.1 | 7 / 1 | |
| 1.66.2 | 7 / 1 |
v1.72.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.72.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.71.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.66.2
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/eclipse-theia/theia/blob/18508653de50e2a0c350e7d131f9447d74475c41/lib/node/hosted-instance-manager.js#L42 40 | const PROCESS_OPTIONS = { 41 | cwd: process.cwd(), > 42 | env: { ...process.env } 43 | }; 44 | let AbstractHostedInstanceManager = class AbstractHostedInstanceManager {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/eclipse-theia/theia/blob/18508653de50e2a0c350e7d131f9447d74475c41/src/node/hosted-instance-manager.ts#L95 93 | const PROCESS_OPTIONS = { 94 | cwd: process.cwd(), > 95 | env: { ...process.env } 96 | }; 97 |
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.