pm2
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | rapid-publish | AI (publish-pattern): Normal for pm2's release cadence. | ai | |
| email-domain | unclaimed-email:pour ce nouveau monde | AI (email-domain): Parsing artifact from author field free-text, not a real email domain. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading env with LC_ALL override for git commands is standard process-manager behavior. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Process manager reads /etc/passwd to resolve user info for managed processes; standard Unix pattern. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Core functionality of a process manager; spawns managed Node.js processes. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode in Serve.js is standard HTTP Basic Auth parsing, not a malicious payload. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): pm2 is a well-established, widely-known package name (4700+ days old, 290 versions); not a typosquat of pg. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require of package.json in NPM.js is standard tooling behavior for reading project metadata. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): pm2 is a process manager that legitimately spawns and manages child processes; child_process usage is core to its functionality. | ai | |
| semgrep | semgrep:child-process-exec | AI (semgrep): pm2 legitimately executes shell commands as part of process management and deployment features. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): pm2 legitimately reads process.env to display environment diffs in its describe/inspect UI. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 7.0.3 | 22 / 3 | |
| 7.0.2 | 22 / 3 | |
| 7.0.1 | 22 / 3 | |
| 7.0.0 | 22 / 3 |
v7.0.3
3 findingsMaintainer email 'Pour ce Nouveau Monde' uses domain 'pour ce nouveau monde' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Unitech/pm2/blob/01d4f6d59c5eaf4ff6683bb38824dcf38d25b289/modules/vizion/lib/git/git.js#L20 18 | timeout, 19 | maxBuffer: MAXBUFFER, > 20 | env: { ...process.env, LC_ALL: 'C', GIT_TERMINAL_PROMPT: '0' } 21 | }).then(({ stdout }) => stdout); 22 | }
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.0.2
3 findingsMaintainer email 'Pour ce Nouveau Monde' uses domain 'pour ce nouveau monde' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/Unitech/pm2/blob/fbad853c05df3f8cad386edba657b33fb6439193/modules/vizion/lib/git/git.js#L20 18 | timeout, 19 | maxBuffer: MAXBUFFER, > 20 | env: { ...process.env, LC_ALL: 'C', GIT_TERMINAL_PROMPT: '0' } 21 | }).then(({ stdout }) => stdout); 22 | }
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.