shakapacker
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:dll-injection-apis | AI (semgrep): LD_PRELOAD etc. appear in an env-var allowlist for inspection, not for injection; stable pattern for this build tool. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): process.env spread passes env to Rails runner subprocess; expected behavior for a webpack/Rails integration tool. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used for build validation (running webpack/rspack); core functionality of this build tool. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads user-supplied webpack config files by path; documented and expected behavior for a webpack wrapper. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Enumerates process.env to expose SHAKAPACKER_PUBLIC_* vars; documented convention similar to Next.js/Vite. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 10.1.0 | 5 / 45 | |
| 10.0.0 | 5 / 44 | |
| 9.7.0 | 4 / 44 | |
| 9.6.1 | 4 / 44 | |
| 9.6.0 | 4 / 44 | |
| 9.5.0 | 4 / 44 |
v10.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
3 findingsDLL injection API detected — potential process injection attack Source: https://github.com/shakacode/shakapacker/blob/103008ed85f6e71313947c7285fd663ecd3992c1/package/configExporter/types.js#L26 24 | "PATH", 25 | "HOME", > 26 | "LD_PRELOAD", 27 | "LD_LIBRARY_PATH", 28 | "DYLD_LIBRARY_PATH",
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/shakacode/shakapacker/blob/103008ed85f6e71313947c7285fd663ecd3992c1/package/rules/erb.js#L12 10 | options: { 11 | runner: `${runner}bin/rails runner`, > 12 | env: { 13 | ...process.env, 14 | DISABLE_SPRING: 1
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.7.0
3 findingsDLL injection API detected — potential process injection attack Source: https://github.com/shakacode/shakapacker/blob/17bf6486ce990436bc5f39879189828b481ee425/package/configExporter/types.js#L26 24 | "PATH", 25 | "HOME", > 26 | "LD_PRELOAD", 27 | "LD_LIBRARY_PATH", 28 | "DYLD_LIBRARY_PATH",
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/shakacode/shakapacker/blob/17bf6486ce990436bc5f39879189828b481ee425/package/rules/erb.js#L12 10 | options: { 11 | runner: `${runner}bin/rails runner`, > 12 | env: { 13 | ...process.env, 14 | DISABLE_SPRING: 1
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.6.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.6.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.