@stencil/core
A Compiler for Web Components and Progressive Web Apps
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used as a documented Chromium bug workaround for dynamic imports with a hardcoded template string — not user-controlled input. Stable pattern in Stencil's browser runtime. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @stencil/core is a long-established, scoped Ionic package; Levenshtein match against 'cors' is a false positive that will never be a real risk for this package. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawning child processes is expected for a dev-server/build tool; used for compiler worker and cross-spawn bundled dependency. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads the Stencil compiler from a computed but controlled path (devServerDir/../compiler/stencil.js) — standard plugin loading pattern. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Dev-server bundles npm-run-path/cross-spawn which spread process.env to pass env to child processes — standard build tool behavior. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get() usage is in bundled node-fetch dependency — standard minified third-party code, not obfuscation. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Env enumeration is in bundled third-party code (debug library) within sys/node/index.js — not malicious. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Stencil dev-server legitimately uses child_process to spawn compiler worker processes — core build tool functionality. | ai |
Versions (showing 51 of 382)
| Version | Deps | Published |
|---|---|---|
| 4.43.5 | 0 / 70 | |
| 4.43.4 | 0 / 70 | |
| 4.43.3 | 0 / 70 | |
| 4.43.2 | 0 / 70 | |
| 4.43.1 | 0 / 70 | |
| 4.43.0 | 0 / 70 | |
| 4.42.1 | 0 / 70 | |
| 4.42.0 | 0 / 70 | |
| 4.41.3 | 0 / 70 | |
| 4.41.2 | 0 / 70 | |
| 4.41.1 | 0 / 70 | |
| 4.41.0 | 0 / 70 | |
| 4.40.1 | 0 / 70 | |
| 4.40.0 | 0 / 70 | |
| 4.39.0 | 0 / 70 | |
| 4.38.3 | 0 / 67 | |
| 4.38.2 | 0 / 67 | |
| 4.38.1 | 0 / 67 | |
| 4.38.0 | 0 / 67 | |
| 4.37.1 | 0 / 67 | |
| 4.37.0 | 0 / 67 | |
| 4.36.3 | 0 / 67 | |
| 4.36.2 | 0 / 67 | |
| 4.36.1 | 0 / 67 | |
| 4.36.0 | 0 / 67 | |
| 4.35.3 | 0 / 67 | |
| 4.35.2 | 0 / 67 | |
| 4.35.1 | 0 / 67 | |
| 4.35.0 | 0 / 67 | |
| 4.34.0 | 0 / 67 | |
| 4.33.1 | 0 / 67 | |
| 4.33.0 | 0 / 67 | |
| 4.32.0 | 0 / 67 | |
| 4.31.0 | 0 / 67 | |
| 4.30.0 | 0 / 67 | |
| 4.29.3 | 0 / 67 | |
| 4.29.2 | 0 / 67 | |
| 4.29.1 | 0 / 67 | |
| 4.29.0 | 0 / 67 | |
| 4.28.2 | 0 / 67 | |
| 4.28.1 | 0 / 67 | |
| 4.28.0 | 0 / 67 | |
| 4.27.2 | 0 / 66 | |
| 4.27.1 | 0 / 66 | |
| 4.27.0 | 0 / 66 | |
| 4.26.0 | 0 / 66 | |
| 4.25.3 | 0 / 66 | |
| 4.25.2 | 0 / 66 | |
| 4.25.1 | 0 / 66 | |
| 4.25.0 | 0 / 66 | |
| 4.24.0 | 0 / 66 |
v4.43.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.43.4
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/stenciljs/core/blob/a1589d9a7d285976ba19cd59c3400028af0dd60d/dev-server/server-process.js#L3656 3654 | var DEFAULT_MAX_BUFFER2 = 1e3 * 1e3 * 100; 3655 | var getEnv2 = ({ env: envOption, extendEnv, preferLocal, localDir, execPath }) => { > 3656 | const env = extendEnv ? { ...process.env, ...envOption } : envOption; 3657 | if (preferLocal) { 3658 | return npmRunPath2.env({ env, cwd: localDir, execPath });
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.43.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.43.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.43.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.43.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.42.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.42.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.41.3
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.41.2
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.41.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.41.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.40.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.40.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.39.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.38.3
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.38.2
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.38.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.38.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.37.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.37.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.36.3
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.36.2
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.36.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.36.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.35.3
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.35.2
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.35.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.35.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.34.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.33.1
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.33.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.32.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.31.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.30.0
2 findingsPackage name '@stencil/core' is 1 edit(s) away from popular package 'cors'.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.29.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.29.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.29.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.29.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.28.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.28.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.28.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.27.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.27.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.27.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.26.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.25.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.25.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.25.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.25.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.24.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.