@yamf/cli
Command-line interface for yamf
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Passes env to child_process spawn for perf benchmarking; standard CLI pattern. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 in an error message string, not an outbound request target. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI tool; child_process usage is expected and legitimate. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @yamf/cli is unrelated to joi; false positive on edit distance. | ai |
v0.9.0
4 findingsSpreading entire process.env into an object — may capture all secrets 34 | const t0 = performance.now() 35 | const node = process.env.YAMF_PERF_NODE || process.execPath > 36 | const childEnv = extraEnv ? { ...process.env, ...extraEnv } : process.env 37 | const p = spawn(node, [yamfBin, ...args], { 38 | cwd,
Spreading entire process.env into an object — may capture all secrets 185 | const port = await pickFreePort() 186 | const url = `http://127.0.0.1:${port}` > 187 | const env = { 188 | ...process.env, 189 | YAMF_REGISTRY_URL: url,
Spreading entire process.env into an object — may capture all secrets 32 | detached: true, 33 | stdio: stdioConfig, > 34 | env: env ? { ...process.env, ...env } : undefined 35 | }) 36 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.0
3 findingsSpreading entire process.env into an object — may capture all secrets 34 | const t0 = performance.now() 35 | const node = process.env.YAMF_PERF_NODE || process.execPath > 36 | const childEnv = extraEnv ? { ...process.env, ...extraEnv } : process.env 37 | const p = spawn(node, [yamfBin, ...args], { 38 | cwd,
Spreading entire process.env into an object — may capture all secrets 32 | detached: true, 33 | stdio: stdioConfig, > 34 | env: env ? { ...process.env, ...env } : undefined 35 | }) 36 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.2.0
2 findingsSpreading entire process.env into an object — may capture all secrets 32 | detached: true, 33 | stdio: stdioConfig, > 34 | env: env ? { ...process.env, ...env } : undefined 35 | }) 36 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.