read-package-json-fast
Like read-package-json, but faster
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:etc-passwd-access | AI (semgrep): False positive: the string '/etc/passwd' appears only in a code comment describing a path traversal defense, not in any credential harvesting logic. | ai | |
| provenance | publisher-changed | AI (provenance): npm CLI team migrated to GitHub Actions CI/CD publishing with SLSA provenance; this is the new standard for all @npm packages. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): Mature npm CLI utility; infrequent publishes are normal. Major version bumps after long gaps are expected lifecycle events. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 6.0.0 | 2 / 3 | |
| 5.0.0 | 2 / 3 | |
| 4.0.0 | 2 / 3 | |
| 3.0.2 | 2 / 3 | |
| 3.0.1 | 2 / 3 | |
| 3.0.0 | 2 / 3 | |
| 2.0.3 | 2 / 1 | |
| 2.0.2 | 2 / 1 | |
| 2.0.1 | 2 / 1 | |
| 2.0.0 | 2 / 1 | |
| 1.2.2 | 2 / 1 | |
| 1.2.1 | 2 / 1 | |
| 1.2.0 | 2 / 1 | |
| 1.1.3 | 2 / 1 | |
| 1.1.2 | 2 / 1 | |
| 1.1.1 | 2 / 1 | |
| 1.1.0 | 1 / 1 | |
| 1.0.3 | 1 / 1 | |
| 1.0.2 | 1 / 1 | |
| 1.0.1 | 1 / 1 | |
| 1.0.0 | 1 / 1 |
v6.0.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.0.0
4 findingsThis version was published by a different npm account than previous versions on 2025-10-23. This could indicate a legitimate maintainer transition or an account compromise.
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/npm/read-package-json-fast/blob/972de8d2d873517f1dcde46b12472fa10b1e9daa/lib/index.js#L25 23 | 24 | // cut off any monkey business, like setting directories.bin > 25 | // to ../../../etc/passwd or /etc/passwd or something like that. 26 | const root = dirname(path) 27 | const dir = join('.', join('/', m))
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux Source: https://github.com/npm/read-package-json-fast/blob/972de8d2d873517f1dcde46b12472fa10b1e9daa/lib/index.js#L25 23 | 24 | // cut off any monkey business, like setting directories.bin > 25 | // to ../../../etc/passwd or /etc/passwd or something like that. 26 | const root = dirname(path) 27 | const dir = join('.', join('/', m))
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v4.0.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version was published by a different npm account than previous versions on 2024-09-25. This could indicate a legitimate maintainer transition or an account compromise.