rcedit
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): rcedit.exe is the core product — a Windows PE resource editor shipped by the Electron org with SLSA provenance. | ai | |
| typosquat | typosquat.levenshtein:redis | AI (typosquat): rcedit is an established Electron tool unrelated to redis; Levenshtein match is coincidental. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env spread passes parent environment to a child process — standard and expected for a subprocess-spawning tool. | ai |
v5.0.2
3 findingsPackage contains compiled binaries that could be backdoors: • bin/rcedit-x64.exe • bin/rcedit.exe
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/electron/node-rcedit/blob/b2e932363feefc800946950ff32332a9de236680/lib/index.js#L34 32 | 33 | const spawnOptions = { > 34 | env: { ...process.env } 35 | } 36 |
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.0.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.