serverless-offline
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Intentional: local Lambda emulator spreads process.env into child process env; this is the documented behavior for localEnvironment mode. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Standard ALB response body decoding; not a malicious payload pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Lambda handler loader by design; loads user-specified handler files at runtime. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): Referenced in config files only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:nock | AI (phantom-deps): Referenced in config files only; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:tree-kill | AI (phantom-deps): Referenced in config files only; stable false positive for this package. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 14.7.1 | 25 / 13 | |
| 14.7.0 | 25 / 13 | |
| 14.6.0 | 25 / 13 | |
| 14.5.0 | 26 / 13 | |
| 13.10.0 | 22 / 13 |
v14.7.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.7.0
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/dherault/serverless-offline/blob/0486ff548f9ed64b3a7544a28ec4cc6a0eaa1da8/src/lambda/handler-runner/ruby-runner/RubyRunner.js#L66 64 | this.#spawnOptions = { 65 | env: options.localEnvironment > 66 | ? { ...process.env, ...this.#env } 67 | : { ...this.#env }, 68 | }
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v14.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v13.10.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.