← Home

@usebruno/js

npm
19
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

anoopmd

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:handlebars AI (dependencies): Handlebars is a well-established templating library; ^4.7.9 is the patched range addressing known XSS/prototype-pollution issues. ai
dependencies unvetted-dep:@usebruno/crypto-js AI (dependencies): Bruno-org maintained fork of crypto-js; consistent across all @usebruno/* package versions. ai
provenance no-provenance AI (provenance): Established Bruno ecosystem package; lack of provenance is consistent across all versions. ai
typosquat typosquat.levenshtein:rxjs AI (typosquat): Same — scoped Bruno package, not a typosquat of rxjs. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Same — scoped Bruno package, not a typosquat of joi. ai
typosquat typosquat.levenshtein:ajv AI (typosquat): Same — scoped Bruno package, not a typosquat of ajv. ai
semgrep semgrep:etc-passwd-access AI (semgrep): Appears in a test spec verifying sandbox blocks /etc/passwd access — not production credential harvesting. ai
semgrep semgrep:dynamic-require AI (semgrep): Part of the CJS loader in a sandboxed VM environment; dynamic require is the core feature being implemented. ai
semgrep semgrep:new-function-constructor AI (semgrep): Used in a sandboxed expression evaluator — expected pattern for this type of JS runtime utility. ai
typosquat typosquat.levenshtein:qs AI (typosquat): @usebruno/js is a scoped package for the Bruno API tool, not a typosquat of qs. ai
semgrep semgrep:base64-decode AI (semgrep): Fires on a bundled moment.js version string line, not actual base64 decode logic. ai
phantom-deps phantom-dep:ajv AI (phantom-deps): ajv is a declared dependency used indirectly via config/schema validation; stable false positive for this package. ai
phantom-deps phantom-dep:xml2js AI (phantom-deps): Declared dependency exposed to sandbox users; indirect usage is expected. ai
phantom-deps phantom-dep:cheerio AI (phantom-deps): Declared dependency exposed to sandbox users; indirect usage is expected. ai
phantom-deps phantom-dep:node-fetch AI (phantom-deps): Declared dependency exposed to sandbox users; indirect usage is expected. ai
phantom-deps phantom-dep:ajv-formats AI (phantom-deps): Companion to ajv; indirect usage via config is expected. ai
semgrep semgrep:api-obfuscation-reflect AI (semgrep): Fires inside bundled chai library code, not package-authored logic. ai
typosquat typosquat.levenshtein:jest AI (typosquat): Same — scoped Bruno package, not a typosquat of jest. ai
typosquat typosquat.levenshtein:pg AI (typosquat): Same — scoped Bruno package, not a typosquat of pg. ai

Versions (showing 19 of 19)

Version Deps Published
0.48.0 25 / 5
0.47.0 25 / 4
0.45.0 23 / 4
0.43.0 24 / 4
0.42.2 24 / 4
0.42.1 24 / 4
0.42.0 24 / 4
0.41.0 24 / 4
0.40.0 22 / 4
0.39.0 22 / 4
0.38.0 23 / 4
0.37.0 23 / 4
0.36.0 23 / 6
0.35.0 23 / 6
0.34.0 23 / 6
0.33.0 23 / 6
0.32.0 23 / 6
0.31.0 23 / 6
0.30.0 23 / 6

v0.48.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.47.0

3 findings
HIGH typosquat.levenshtein: Possible typosquat of 'qs' typosquat

Package name '@usebruno/js' is 1 edit(s) away from popular package 'qs'.

HIGH etc-passwd-access: src/sandbox/node-vm/index.spec.js:113 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 111 | // Try to require an absolute path outside the collection 112 | const script = ` > 113 | const secret = require('/etc/passwd'); 114 | `; 115 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.45.0

3 findings
HIGH typosquat.levenshtein: Possible typosquat of 'qs' typosquat

Package name '@usebruno/js' is 1 edit(s) away from popular package 'qs'.

HIGH etc-passwd-access: src/sandbox/node-vm/index.spec.js:113 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 111 | // Try to require an absolute path outside the collection 112 | const script = ` > 113 | const secret = require('/etc/passwd'); 114 | `; 115 |

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.43.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.42.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.42.1

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'qs' typosquat

Package name '@usebruno/js' is 1 edit(s) away from popular package 'qs'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.42.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.41.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.40.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.39.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.38.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.37.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.36.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.35.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.34.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.33.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.32.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.31.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.30.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.