← Home

@yao-pkg/pkg

npm Repository Homepage
11
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

roberts_lando

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:env-spread AI (semgrep): Intentional env inheritance for spawned child processes in a Node.js packager; documented workaround, not exfiltration. ai
semgrep semgrep:new-function-constructor AI (semgrep): new Function used to preserve dynamic import() semantics past TypeScript compilation — documented pattern. ai
typosquat typosquat.levenshtein:pg AI (typosquat): @yao-pkg/pkg is a well-known Node.js packager tool, not a typosquat of the PostgreSQL client 'pg'. ai
semgrep semgrep:child-process-import AI (semgrep): child_process is required by pkg's fabricator to build executables; intrinsic to the tool's purpose. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is used to load user-supplied pkg config files; documented and expected behavior. ai
phantom-deps phantom-dep:prebuild-install AI (phantom-deps): prebuild-install is a declared runtime dep used implicitly by native binary dependencies; stable false positive. ai

Versions (showing 11 of 11)

Version Deps Published
6.19.0 19 / 26
6.18.1 20 / 27
6.18.0 20 / 27
6.15.0 20 / 27
6.14.2 18 / 27
6.14.1 18 / 27
6.14.0 18 / 27
6.13.1 18 / 26
6.13.0 18 / 26
6.12.0 15 / 27
6.11.0 15 / 27

v6.19.0

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'pg' typosquat

Package name '@yao-pkg/pkg' is 1 edit(s) away from popular package 'pg'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.18.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.18.0

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'pg' typosquat

Package name '@yao-pkg/pkg' is 1 edit(s) away from popular package 'pg'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.15.0

2 findings
HIGH typosquat.levenshtein: Possible typosquat of 'pg' typosquat

Package name '@yao-pkg/pkg' is 1 edit(s) away from popular package 'pg'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.14.2

2 findings
HIGH env-spread: prelude/bootstrap.js:1997 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/439c64e64ca4979a9dc7e814ecd5c8811d1ac65c/prelude/bootstrap.js#L1997 1995 | } 1996 | const opts = args[pos]; > 1997 | if (!opts.env) opts.env = { ...process.env }; 1998 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 1999 | if (opts.env.PKG_EXECPATH !== undefined) return;

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v6.14.1

2 findings
HIGH env-spread: prelude/bootstrap.js:1997 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/290d9ba2f6840b36163180133462875633127482/prelude/bootstrap.js#L1997 1995 | } 1996 | const opts = args[pos]; > 1997 | if (!opts.env) opts.env = { ...process.env }; 1998 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 1999 | if (opts.env.PKG_EXECPATH !== undefined) return;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.14.0

2 findings
HIGH env-spread: prelude/bootstrap.js:1997 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/0f438313e6fb7209c4f40a631fe1725c5f1518fc/prelude/bootstrap.js#L1997 1995 | } 1996 | const opts = args[pos]; > 1997 | if (!opts.env) opts.env = { ...process.env }; 1998 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 1999 | if (opts.env.PKG_EXECPATH !== undefined) return;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.13.1

2 findings
HIGH env-spread: prelude/bootstrap.js:2003 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/332c1881998574d3170707ffcd8407bf3dcdd783/prelude/bootstrap.js#L2003 2001 | } 2002 | const opts = args[pos]; > 2003 | if (!opts.env) opts.env = { ...process.env }; 2004 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 2005 | if (opts.env.PKG_EXECPATH !== undefined) return;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.13.0

2 findings
HIGH env-spread: prelude/bootstrap.js:2003 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/645b0e89164387733f75b62d3fb98052a1c4a52c/prelude/bootstrap.js#L2003 2001 | } 2002 | const opts = args[pos]; > 2003 | if (!opts.env) opts.env = { ...process.env }; 2004 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 2005 | if (opts.env.PKG_EXECPATH !== undefined) return;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.12.0

2 findings
HIGH env-spread: prelude/bootstrap.js:2003 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/5807ed2fef6d6fc6088261f27968cac83054db83/prelude/bootstrap.js#L2003 2001 | } 2002 | const opts = args[pos]; > 2003 | if (!opts.env) opts.env = { ...process.env }; 2004 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 2005 | if (opts.env.PKG_EXECPATH !== undefined) return;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.11.0

2 findings
HIGH env-spread: prelude/bootstrap.js:2003 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/yao-pkg/pkg/blob/6fe9259f3aa26a408c7775359808013aed28f5ea/prelude/bootstrap.js#L2003 2001 | } 2002 | const opts = args[pos]; > 2003 | if (!opts.env) opts.env = { ...process.env }; 2004 | // see https://github.com/vercel/pkg/issues/897#issuecomment-1049370335 2005 | if (opts.env.PKG_EXECPATH !== undefined) return;

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.