artillery
Cloud-scale load testing. https://www.artillery.io
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Passes process.env to subprocess for npm install; standard pattern for this tool. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads user-configured custom reporters by name; documented plugin loader pattern. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Simple atob/btoa polyfill for AWS ECS utility; no malicious payload. | ai | |
| phantom-deps | phantom-dep:yaml-js | AI (phantom-deps): Declared dep loaded by convention/config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:cross-spawn | AI (phantom-deps): Declared dep used transitively/by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:jsonwebtoken | AI (phantom-deps): Declared dep used by convention; stable false positive. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-help | AI (phantom-deps): oclif plugin loaded by framework convention, not direct import. | ai | |
| phantom-deps | phantom-dep:artillery-plugin-apdex | AI (phantom-deps): First-party artillery plugin loaded by convention. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-not-found | AI (phantom-deps): oclif plugin loaded by framework convention. | ai | |
| phantom-deps | phantom-dep:artillery-plugin-expect | AI (phantom-deps): First-party artillery plugin loaded by convention. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/client-cloudwatch | AI (phantom-deps): Framework-scoped AWS SDK package loaded by convention. | ai | |
| phantom-deps | phantom-dep:artillery-plugin-fake-data | AI (phantom-deps): First-party artillery plugin loaded by convention. | ai | |
| phantom-deps | phantom-dep:artillery-engine-playwright | AI (phantom-deps): First-party artillery engine loaded by convention. | ai | |
| phantom-deps | phantom-dep:artillery-plugin-metrics-by-endpoint | AI (phantom-deps): First-party artillery plugin loaded by convention. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 2.0.31 | 57 / 9 | |
| 2.0.30 | 56 / 9 | |
| 2.0.29 | 56 / 9 | |
| 2.0.28 | 56 / 9 | |
| 2.0.27 | 56 / 9 |
v2.0.31
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/artilleryio/artillery/blob/44c92f377e8725af5988da22367e2e81265c6ca8/lib/platform/aws-lambda/lambda-handler/a9-handler-dependencies.js#L40 38 | await runProcess('npm', ['install', dep, '--prefix', testDataLocation], { 39 | log: true, > 40 | env: { 41 | ...process.env, 42 | HOME: testDataLocation
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/artilleryio/artillery/blob/44c92f377e8725af5988da22367e2e81265c6ca8/lib/platform/aws-lambda/lambda-handler/a9-handler-dependencies.js#L50 48 | await runProcess('npm', ['init', '-y', '--quiet'], { 49 | log: true, > 50 | env: { 51 | ...process.env, 52 | HOME: testDataLocation
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/artilleryio/artillery/blob/44c92f377e8725af5988da22367e2e81265c6ca8/lib/platform/aws-lambda/lambda-handler/a9-handler-dependencies.js#L62 60 | { 61 | log: true, > 62 | env: { 63 | ...process.env, 64 | HOME: testDataLocation
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/artilleryio/artillery/blob/44c92f377e8725af5988da22367e2e81265c6ca8/lib/platform/local/artillery-worker-local.js#L14 12 | 13 | const returnWorkerEnv = (needsSourcemap) => { > 14 | const env = { ...process.env }; 15 | 16 | if (needsSourcemap) {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.