terminal-size
Reliably get the terminal window size (columns & rows)
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Passing env to tput subprocess is standard terminal-detection practice; stable for this package. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 4.0.0 | 0 / 4 |
v4.0.0
3 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/sindresorhus/terminal-size/blob/e2393bccff7175e3740492b253ca967601aab22d/index.js#L84 82 | try { 83 | // `tput` requires the `TERM` environment variable to be set. > 84 | const columns = exec('tput', ['cols'], {env: {TERM: 'dumb', ...process.env}}); 85 | const rows = exec('tput', ['lines'], {env: {TERM: 'dumb', ...process.env}}); 86 |
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/sindresorhus/terminal-size/blob/e2393bccff7175e3740492b253ca967601aab22d/index.js#L85 83 | // `tput` requires the `TERM` environment variable to be set. 84 | const columns = exec('tput', ['cols'], {env: {TERM: 'dumb', ...process.env}}); > 85 | const rows = exec('tput', ['lines'], {env: {TERM: 'dumb', ...process.env}}); 86 | 87 | if (columns && rows) {
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.