firebase-tools
51
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
firebase-opsfeiyang.chengoogle-wombotchholland
Keywords
cdnclisslcloudhostingfirebaserealtimewebsocketssynchronization
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:abort-controller | AI (phantom-deps): Config-referenced indirect import; stable pattern for this CLI package. | ai | |
| phantom-deps | phantom-dep:proxy-agent | AI (phantom-deps): Config-referenced indirect import; stable pattern for this CLI package. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): Config-referenced indirect import; stable pattern for this CLI package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): firebase-tools is a large CLI tool that regularly adds many source files per release; this pattern is expected and not indicative of injected code. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): firebase-tools regularly adds new dependencies as the CLI evolves; tar is a well-known, legitimate npm package appropriate for a CLI tool of this scope. | ai | |
| phantom-deps | phantom-dep:pglite-2 | AI (phantom-deps): Phantom dependency referenced in config; legitimate for Firebase feature integration. | ai | |
| phantom-deps | phantom-dep:@electric-sql/pglite-tools | AI (phantom-deps): Phantom dependency referenced in config; legitimate for Firebase database feature. | ai | |
| phantom-deps | phantom-dep:universal-analytics | AI (phantom-deps): Phantom dependency referenced in config; legitimate for Firebase analytics integration. | ai | |
| phantom-deps | phantom-dep:@apphosting/common | AI (phantom-deps): Phantom dependency referenced in config; legitimate for Firebase App Hosting feature. | ai | |
| phantom-deps | phantom-dep:gaxios | AI (phantom-deps): Phantom dependency referenced in config; legitimate for CLI tool managing multiple Firebase services. | ai | |
| dependencies | unvetted-dep:pg-gateway | AI (dependencies): pg-gateway is a legitimate dependency for firebase-tools' emulator/dataconnect functionality; expected for this package. | ai | |
| dependencies | unvetted-dep:pglite-2 | AI (dependencies): pglite-2 is a legitimate dependency for firebase-tools' local emulator functionality; expected for this package. | ai | |
| dependencies | unvetted-dep:@google-cloud/cloud-sql-connector | AI (dependencies): Official Google Cloud connector package, consistent with Firebase tooling ecosystem. Expected dependency for firebase-tools. | ai | |
| dependencies | unvetted-dep:@apphosting/build | AI (dependencies): Google App Hosting build package, consistent with Firebase App Hosting feature development in firebase-tools. | ai | |
| phantom-deps | phantom-dep:mime | AI (phantom-deps): Phantom deps are common in monorepos and packages with indirect transitive usage; not a security issue. | ai | |
| phantom-deps | phantom-dep:deep-equal-in-any-order | AI (phantom-deps): Phantom deps are common in monorepos and packages with indirect transitive usage; not a security issue. | ai | |
| dependencies | unvetted-dep:exegesis | AI (dependencies): exegesis is a legitimate OpenAPI middleware library; appropriate dependency for firebase-tools. | ai | |
| dependencies | unvetted-dep:deep-equal-in-any-order | AI (dependencies): Test utility library; low risk, appropriate for firebase-tools. | ai | |
| dependencies | unvetted-dep:@google-cloud/pubsub | AI (dependencies): Google's own Pub/Sub client library; expected dependency for a Google Firebase CLI tool. | ai | |
| dependencies | unvetted-dep:update-notifier-cjs | AI (dependencies): update-notifier-cjs is a CJS fork of update-notifier; standard CLI update notification pattern. | ai | |
| dependencies | unvetted-dep:exegesis-express | AI (dependencies): exegesis-express is a legitimate Express middleware for OpenAPI; appropriate for firebase-tools. | ai | |
| dependencies | unvetted-dep:superstatic | AI (dependencies): superstatic is the Firebase static file server used by firebase-tools for local hosting emulation. | ai | |
| dependencies | unvetted-dep:stream-json | AI (dependencies): stream-json is a well-known streaming JSON parser; appropriate for firebase-tools data handling. | ai | |
| provenance | no-provenance | AI (provenance): firebase-tools is a high-trust Google package with 4400+ days of history; lack of Sigstore provenance is not a disqualifier here. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval('require') is a bundler workaround for dynamic imports; standard pattern in Node.js tooling. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Standard ESM dynamic import shim in CJS context; not malicious code generation. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Connects to 127.0.0.1 (localhost) for local emulator discovery; completely benign. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 validation in account import functionality; expected for Firebase auth tooling. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Standard CLI command-loader pattern: require(`./${name}`) from known commands directory. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): CLI tool spawning processes for lifecycle hooks is core functionality. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Firebase CLI necessarily spawns child processes for builds, deployments, and emulators. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): CLI tool saves/restores process.env during local builds; standard behavior for build orchestration, not secret exfiltration. | ai |
Versions (showing 51 of 92)
| Version | Deps | Published |
|---|---|---|
| 15.23.0 | 70 / 0 | |
| 15.16.0 | 76 / 0 | |
| 15.13.0 | 76 / 0 | |
| 15.12.0 | 76 / 0 | |
| 15.10.0 | 75 / 0 | |
| 15.3.1 | 75 / 0 | |
| 15.3.0 | 75 / 0 | |
| 15.2.1 | 75 / 0 | |
| 15.1.0 | 75 / 0 | |
| 15.0.0 | 75 / 0 | |
| 14.25.1 | 76 / 0 | |
| 14.25.0 | 76 / 0 | |
| 14.21.0 | 76 / 0 | |
| 14.20.0 | 76 / 0 | |
| 14.15.1 | 74 / 0 | |
| 14.10.0 | 74 / 0 | |
| 14.8.0 | 74 / 0 | |
| 14.7.0 | 72 / 0 | |
| 14.6.0 | 72 / 0 | |
| 14.5.1 | 71 / 0 | |
| 14.5.0 | 71 / 0 | |
| 14.4.0 | 71 / 0 | |
| 14.3.1 | 70 / 0 | |
| 14.3.0 | 70 / 0 | |
| 14.2.2 | 71 / 0 | |
| 14.2.1 | 68 / 0 | |
| 14.2.0 | 68 / 0 | |
| 14.1.0 | 68 / 0 | |
| 14.0.1 | 68 / 0 | |
| 14.0.0 | 68 / 0 | |
| 13.35.1 | 68 / 0 | |
| 13.35.0 | 68 / 0 | |
| 13.34.0 | 68 / 0 | |
| 13.33.0 | 68 / 0 | |
| 13.32.0 | 68 / 0 | |
| 13.31.2 | 68 / 0 | |
| 13.31.1 | 68 / 0 | |
| 13.31.0 | 68 / 0 | |
| 13.30.0 | 68 / 0 | |
| 13.29.3 | 68 / 0 | |
| 13.29.2 | 68 / 0 | |
| 13.29.1 | 67 / 0 | |
| 13.29.0 | 67 / 0 | |
| 13.28.0 | 67 / 0 | |
| 13.27.0 | 66 / 0 | |
| 13.26.0 | 66 / 0 | |
| 13.25.0 | 66 / 0 | |
| 13.24.2 | 66 / 0 | |
| 13.24.1 | 66 / 0 | |
| 13.24.0 | 66 / 0 | |
| 13.23.1 | 66 / 0 |
v15.23.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.20.0
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.