← Home

pacote

npm Repository Homepage

JavaScript package downloader

51
Versions
ISC
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

garsaquibkhannpm-cli-opsreggihashtagchrisowlstronaut

Keywords

packagesnpmgit

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): npm org packages now publish via GitHub Actions CI/CD with SLSA provenance; this is the expected publisher for all future npm CLI packages. ai
semgrep semgrep:env-spread AI (semgrep): pacote spawns npm install for git deps and must pass the parent environment; standard subprocess invocation pattern. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes DSSE envelope payloads from Sigstore attestations; base64 is the canonical encoding per the DSSE spec. ai
semgrep semgrep:child-process-import AI (semgrep): pacote is a git-aware package fetcher; importing child_process to run git commands is core, documented functionality across all versions. ai
semgrep semgrep:child-process-spawn AI (semgrep): Spawning the git binary is the intended mechanism for pacote's git dependency support; stable and expected across all versions. ai
semgrep semgrep:env-bulk-read AI (semgrep): process.env enumeration in git.js is used to filter safe env vars for git subprocess — a security-conscious allowlist pattern, not malicious. Stable for this package. ai

Versions (showing 51 of 231)

View all versions
Version Deps Published
21.4.0 17 / 9
21.3.1 17 / 9
21.3.0 17 / 9
21.2.0 17 / 9
21.1.0 17 / 9
21.0.4 17 / 9
21.0.3 17 / 9
21.0.2 17 / 9
21.0.1 17 / 9
21.0.0 17 / 9
20.0.1 17 / 8
20.0.0 17 / 8
19.0.2 17 / 8
19.0.1 17 / 8
19.0.0 17 / 8
18.0.6 17 / 8
18.0.5 17 / 8
18.0.4 17 / 8
18.0.3 17 / 8
18.0.2 17 / 8
18.0.1 17 / 8
18.0.0 18 / 8
17.0.7 18 / 8
17.0.6 18 / 8
17.0.5 18 / 8
17.0.4 18 / 8
17.0.3 18 / 8
17.0.2 18 / 8
17.0.1 18 / 8
17.0.0 18 / 8
16.0.0 18 / 8
15.2.0 18 / 8
15.1.3 18 / 8
15.1.2 18 / 8
15.1.1 18 / 8
15.1.0 18 / 8
15.0.8 17 / 8
15.0.7 17 / 8
15.0.6 17 / 8
15.0.5 17 / 8
15.0.4 17 / 8
15.0.3 17 / 8
15.0.2 17 / 8
15.0.1 17 / 8
15.0.0 17 / 8
14.0.0 21 / 8
13.6.2 21 / 7
13.6.1 21 / 7
13.6.0 21 / 7
13.5.0 21 / 7
13.4.1 21 / 7

v21.4.0

2 findings
HIGH env-spread: lib/git.js:195 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/e3871d830ad0d9e4c3a71502dc77c309804671f9/lib/git.js#L195 193 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 194 | dir, > 195 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 196 | { message: 'git dep preparation failed' } 197 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.3.1

2 findings
HIGH env-spread: lib/git.js:195 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/18d36e64a6cc44ac28b7ed2b45e6d2dda4dcf317/lib/git.js#L195 193 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 194 | dir, > 195 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 196 | { message: 'git dep preparation failed' } 197 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.3.0

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/411ceb6ea4326d7cfa70325068821bf8f98c8531/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.2.0

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/27cc5e11c8c1f515f3c96abcaefab702ffcce2b3/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.1.0

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/7c9469ddd04bd03bee0d42e99411c6be8c6a2478/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.0.4

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/4b559c4c663a23f988f6be5094c9a45faf6231bc/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.0.3

3 findings
HIGH Publisher changed: npm-cli-ops → GitHub Actions (on 2025-09-17) provenance

This version was published by a different npm account than previous versions on 2025-09-17. This could indicate a legitimate maintainer transition or an account compromise.

HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/5a3261c5f96a838e828b834851431aa03d459a27/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.0.2

3 findings
HIGH Publisher changed: npm-cli-ops → GitHub Actions (on 2025-09-17) provenance

This version was published by a different npm account than previous versions on 2025-09-17. This could indicate a legitimate maintainer transition or an account compromise.

HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/2c8720d0c9856c1fa7bb3037cd26bd1570f134bf/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.0.1

3 findings
HIGH Publisher changed: npm-cli-ops → GitHub Actions (on 2025-09-03) provenance

This version was published by a different npm account than previous versions on 2025-09-03. This could indicate a legitimate maintainer transition or an account compromise.

HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/1fcf88fc98c07144690e4045347760eb34cbfa7a/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v21.0.0

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/bf1f60f58bb61f053262f54724edcacaadb221ce/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v20.0.1

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/d191a579a3e4fbf6c7342fbc61e9ecc280b5e102/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v20.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.0.2

2 findings
HIGH env-spread: lib/git.js:187 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/npm/pacote/blob/a53be38302e1188b7026a3513ab7a8c1079db85c/lib/git.js#L187 185 | [].concat(this.npmInstallCmd).concat(this.npmCliConfig), 186 | dir, > 187 | { ...process.env, _PACOTE_NO_PREPARE_: noPrepare.join('\n') }, 188 | { message: 'git dep preparation failed' } 189 | )

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v19.0.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v18.0.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.