datagrok-tools No license 47 versions

datagrok-tools

npm Homepage

Utility to upload and publish packages to Datagrok

47

Versions

—

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

aparamonov_datagrokskalkindrizhinappolovyi_datagrokaleksashka_11

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:env-spread	AI (semgrep): Playwright test runner spreading process.env to child test process is expected behavior for this CLI tool.	ai	2026/05/22
semgrep	semgrep:dynamic-require	AI (semgrep): Resolves globally-installed npm plugins via webpack config; standard CLI tooling pattern for this package.	ai	2026/05/04
dependencies	unvetted-dep:puppeteer-screen-recorder	AI (dependencies): Screen recording dep for puppeteer-based testing; expected for this tool.	ai	2026/05/04
dependencies	unvetted-dep:archiver-promise	AI (dependencies): Stable dependency for this CLI tool across many versions; no malware indicators.	ai	2026/05/04
dependencies	unvetted-dep:node-recursive-directory	AI (dependencies): Utility dep used by this CLI tool; no malware indicators.	ai	2026/05/04
phantom-deps	phantom-dep:@typescript-eslint/visitor-keys	AI (phantom-deps): Loaded via eslint config convention; stable false positive.	ai	2026/05/02
phantom-deps	phantom-dep:@babel/traverse	AI (phantom-deps): Framework-scoped Babel package loaded by convention; stable false positive.	ai	2026/05/02
bogus-package	bogus-package	AI (bogus-package): Established 331-version CLI tool; sparse README/keywords are cosmetic, not spam indicators.	ai	2026/05/02
phantom-deps	phantom-dep:archiver	AI (phantom-deps): archiver is declared as a dependency and used via archiver-promise wrapper; phantom detection is a false positive.	ai	2026/05/02
phantom-deps	phantom-dep:estraverse	AI (phantom-deps): estraverse used via config/convention in AST traversal tooling; stable false positive.	ai	2026/05/02
phantom-deps	phantom-dep:@babel/parser	AI (phantom-deps): Framework-scoped Babel package loaded by convention; stable false positive.	ai	2026/05/02
semgrep	semgrep:child-process-import	AI (semgrep): CLI build tool; child_process is expected for invoking compilers/bundlers.	ai	2026/05/02
semgrep	semgrep:base64-decode	AI (semgrep): Base64 decode appears only in test assertions, not in runtime code paths.	ai	2026/05/02
semgrep	semgrep:eval-usage	AI (semgrep): eval used in test runner to execute remote test functions — documented test-utils pattern.	ai	2026/05/02

Versions (showing 47 of 47)

Version	Deps	Published
6.2.6	22 / 21	2026-05-26
6.2.5	22 / 21	2026-05-21
6.2.4	22 / 21	2026-05-13
6.2.3	22 / 21	2026-05-06
6.2.2	22 / 21	2026-05-05
6.2.1	22 / 21	2026-05-05
6.2.0	22 / 21	2026-05-04
6.1.14	22 / 21	2026-05-01
6.1.13	23 / 21	2026-04-30
6.1.12	23 / 21	2026-04-29
6.1.11	23 / 21	2026-04-27
6.1.10	22 / 20	2026-04-17
6.1.9	22 / 19	2026-04-08
6.1.8	22 / 19	2026-04-08
6.1.7	22 / 19	2026-04-08
6.1.6	22 / 19	2026-04-01
6.1.5	22 / 19	2026-03-31
6.1.4	22 / 19	2026-03-31
6.1.3	22 / 19	2026-03-31
6.1.1	22 / 19	2026-03-30
6.1.0	22 / 19	2026-03-25
6.0.8	22 / 19	2026-03-18
6.0.7	22 / 19	2026-03-18
6.0.6	22 / 19	2026-03-17
6.0.5	22 / 19	2026-03-17
6.0.4	22 / 19	2026-03-17
6.0.3	22 / 19	2026-03-16
6.0.2	22 / 19	2026-03-13
6.0.1	22 / 19	2026-03-13
6.0.0	22 / 19	2026-03-12
5.1.9	22 / 19	2026-02-25
5.1.8	22 / 19	2026-02-25
5.1.7	22 / 19	2026-02-19
5.1.6	22 / 19	2026-02-18
5.1.5	22 / 19	2026-02-04
5.1.4	22 / 19	2026-02-03
5.1.3	22 / 19	2026-02-03
5.1.2	22 / 19	2026-02-03
5.1.1	22 / 19	2026-02-02
5.0.0	22 / 19	2026-01-14
4.14.73	23 / 19	2026-01-13
4.14.72	22 / 20	2026-01-13
4.14.71	22 / 20	2026-01-10
4.14.70	22 / 20	2026-01-10
4.14.69	22 / 19	2025-11-18
4.14.68	22 / 19	2025-11-12
4.14.67	22 / 19	2025-11-10

v6.2.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.5

2 findings

HIGH env-spread: bin/utils/playwright-runner.js:161 semgrep

Spreading entire process.env into an object — may capture all secrets 159 | } 160 | if (testDirFinal !== testDir) cliArgs.push(testDirFinal); > 161 | const env = { 162 | ...process.env, 163 | DATAGROK_URL: webUrl,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.4

2 findings

HIGH env-spread: bin/utils/playwright-runner.js:161 semgrep

Spreading entire process.env into an object — may capture all secrets 159 | } 160 | if (testDirFinal !== testDir) cliArgs.push(testDirFinal); > 161 | const env = { 162 | ...process.env, 163 | DATAGROK_URL: webUrl,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.3

2 findings

HIGH env-spread: bin/utils/playwright-runner.js:161 semgrep

Spreading entire process.env into an object — may capture all secrets 159 | } 160 | if (testDirFinal !== testDir) cliArgs.push(testDirFinal); > 161 | const env = { 162 | ...process.env, 163 | DATAGROK_URL: webUrl,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.2

2 findings

HIGH env-spread: bin/utils/playwright-runner.js:161 semgrep

Spreading entire process.env into an object — may capture all secrets 159 | } 160 | if (testDirFinal !== testDir) cliArgs.push(testDirFinal); > 161 | const env = { 162 | ...process.env, 163 | DATAGROK_URL: webUrl,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.1

2 findings

HIGH env-spread: bin/utils/playwright-runner.js:161 semgrep

Spreading entire process.env into an object — may capture all secrets 159 | } 160 | if (testDirFinal !== testDir) cliArgs.push(testDirFinal); > 161 | const env = { 162 | ...process.env, 163 | DATAGROK_URL: webUrl,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.2.0

2 findings

HIGH env-spread: bin/utils/playwright-runner.js:157 semgrep

Spreading entire process.env into an object — may capture all secrets 155 | } 156 | if (testDirFinal !== testDir) cliArgs.push(testDirFinal); > 157 | const env = { 158 | ...process.env, 159 | DATAGROK_URL: webUrl,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.1.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.1.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.1.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v5.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.14.73

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.14.72

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.14.71

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.14.70

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.14.69

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.14.68

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.14.67

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.