freestyle
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:silent-process-exec | AI (semgrep): Fires on macOS `open [url]` browser-launch pattern in CLI; benign and stable for this package. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same macOS browser-launch spawn call; not a malicious detached process. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 0.1.52 | 0 / 0 | |
| 0.1.51 | 0 / 0 | |
| 0.1.50 | 0 / 0 | |
| 0.1.49 | 0 / 0 | |
| 0.1.48 | 0 / 0 | |
| 0.1.47 | 0 / 0 | |
| 0.1.46 | 0 / 0 | |
| 0.1.45 | 0 / 0 | |
| 0.1.44 | 0 / 0 |
v0.1.52
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.51
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.50
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.49
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.48
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.47
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.46
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.45
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.44
7 findingsSilent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 261 | try { 262 | if (process.platform === "darwin") { > 263 | const child2 = spawn("open", [url], { 264 | stdio: "ignore", 265 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 269 | } 270 | if (process.platform === "win32") { > 271 | const child2 = spawn("cmd", ["/c", "start", "", url], { 272 | stdio: "ignore", 273 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Silent detached process — runs invisibly in the background (reverse shells, miners) 276 | return true; 277 | } > 278 | const child = spawn("xdg-open", [url], { 279 | stdio: "ignore", 280 | detached: true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.