@wireio/test-cluster-tool
Core library and CLI for creating, running, and tearing down multi-chain WIRE test clusters. Ships the `wire-test-cluster` binary, process managers for every cluster component, and typed clients for WIRE / Ethereum / Solana.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into child_process spawn options for Hardhat; standard pattern for this cluster tool. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): All raw IP references are localhost/127.0.0.1 for local cluster URL construction; not exfiltration. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Cluster orchestration tool legitimately spawns child processes (Hardhat, CLI clients). | ai | |
| phantom-deps | phantom-dep:@wireio/shared-node | AI (phantom-deps): Same org scope; likely used transitively or in config files. | ai | |
| phantom-deps | phantom-dep:@wireio/opp-solidity-models | AI (phantom-deps): Same org scope; likely used transitively or in config files. | ai |
v0.1.9
5 findingsSpreading entire process.env into an object — may capture all secrets 179 | timeout: HardhatDeployTimeoutMs, 180 | maxBuffer: HardhatDeployBufferBytes, > 181 | env: { 182 | ...process.env, 183 | // Ensure hardhat uses the right network config
Spreading entire process.env into an object — may capture all secrets 235 | const exitDeferred = new shared_1.Deferred(), pidFile = this.toProcessPidPath(config.label), child = (0, child_p 236 | cwd: config.cwd, > 237 | env: { 238 | ...process.env, 239 | ...(config.env ?? {})
Spreading entire process.env into an object — may capture all secrets 253 | timeout: HardhatDeployTimeoutMs, 254 | maxBuffer: HardhatDeployBufferBytes, > 255 | env: { 256 | ...process.env, 257 | // Ensure hardhat uses the right network config
Spreading entire process.env into an object — may capture all secrets 305 | child = spawn(config.command, config.args, { 306 | cwd: config.cwd, > 307 | env: { 308 | ...process.env, 309 | ...(config.env ?? {})
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.5
3 findingsSpreading entire process.env into an object — may capture all secrets 179 | timeout: HardhatDeployTimeoutMs, 180 | maxBuffer: HardhatDeployBufferBytes, > 181 | env: { 182 | ...process.env, 183 | // Ensure hardhat uses the right network config
Spreading entire process.env into an object — may capture all secrets 235 | const exitDeferred = new shared_1.Deferred(), pidFile = this.toProcessPidPath(config.label), child = (0, child_p 236 | cwd: config.cwd, > 237 | env: { 238 | ...process.env, 239 | ...(config.env ?? {})
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.