adminforth
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:sanitize-html | AI (phantom-deps): sanitize-html is listed as a direct dependency in package.json; phantom-dep is a false positive here. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Established framework with 1944 versions and 6.1k weekly downloads; bogus-package signals are false positives here. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Used in CLI callTsProxy.js to forward env to child process with augmented PATH — standard and benign pattern for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): multer and sanitize-html are well-established packages fitting the admin panel's file upload and HTML sanitization use cases. | ai | |
| phantom-deps | phantom-dep:pino-pretty | AI (phantom-deps): pino-pretty is a logging formatter loaded by convention, not direct import. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs pnpm install on bundled SPA; documented pattern for this admin panel framework. | ai | |
| phantom-deps | phantom-dep:@faker-js/faker | AI (phantom-deps): Referenced in config/demo files; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/express | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used only to run pnpm install in postinstall; benign for this package. | ai | |
| semgrep | semgrep:child-process-execsync | AI (semgrep): execSync runs fixed pnpm install command; no user-controlled input, stable pattern. | ai | |
| phantom-deps | phantom-dep:esm | AI (phantom-deps): esm is a runtime loader referenced in config; phantom-dep heuristic false positive. | ai |
Versions (showing 12 of 12)
| Version | Deps | Published |
|---|---|---|
| 2.65.0 | 41 / 6 | |
| 2.64.0 | 41 / 6 | |
| 2.63.0 | 41 / 6 | |
| 2.62.0 | 41 / 6 | |
| 2.60.6 | 41 / 6 | |
| 2.60.3 | 41 / 6 | |
| 2.59.0 | 41 / 6 | |
| 2.58.6 | 41 / 6 | |
| 2.50.0 | 39 / 6 | |
| 2.49.0 | 39 / 6 | |
| 2.39.2 | 39 / 6 | |
| 2.7.4 | 28 / 4 |
v2.65.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vanbrosh) than the most recent previously approved version (yaroslav8765) on 2026-05-22, but vanbrosh is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.64.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vanbrosh) than the most recent previously approved version (yaroslav8765) on 2026-05-22, but vanbrosh is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.63.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vanbrosh) than the most recent previously approved version (yaroslav8765) on 2026-05-22, but vanbrosh is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.62.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vanbrosh) than the most recent previously approved version (yaroslav8765) on 2026-05-22, but vanbrosh is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.60.6
2 findingsThis version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.60.3
2 findingsThis version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.59.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/devforth/adminforth/blob/4c43e479eedf7a2550d45a0af880863f9f770f2c/commands/callTsProxy.js#L26 24 | const currentPath = process.env[pathKey] || ""; 25 | > 26 | return { 27 | ...process.env, 28 | [pathKey]: [localBinPath, currentPath].filter(Boolean).join(path.delimiter),
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.58.6
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/devforth/adminforth/blob/cf0057895e607c96fbf205cbc31dc99a2a324f71/commands/callTsProxy.js#L26 24 | const currentPath = process.env[pathKey] || ""; 25 | > 26 | return { 27 | ...process.env, 28 | [pathKey]: [localBinPath, currentPath].filter(Boolean).join(path.delimiter),
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.49.0
2 findingsScript: node scripts/postinstall.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.39.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.7.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.