@twilio/mcs-client
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-exfil-services | AI (semgrep): Pastebin URL in a doc comment within bundled build output; not executed code. | ai |
v0.6.12
2 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) 5645 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 5646 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 5647 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 5648 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 5649 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.11
2 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) 5645 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 5646 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 5647 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 5648 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 5649 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.10
2 findingsURL pointing to known exfiltration/tunneling service (matched inside a comment — likely documentation, not executed code) 5645 | // but for some reason `nativeSlice.call(result, 1, result.length)` (called in 5646 | // the slice polyfill when slicing native arrays) "doesn't work" in safari 9 and > 5647 | // causes a crash (https://pastebin.com/N21QzeQA) when trying to debug it. 5648 | for (var j = 1; j < result.length; j++) captures.push(maybeToString(result[j])); 5649 | var namedCaptures = result.groups;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.