Fix bundled environment/network safety finding - #389
Conversation
Bundle Size Report
|
|
🔄 New commits pushed 8 new commits (+330 / -106) Latest commits:• 3bcbe76 fix(security): isolate npm release network access (Mark Goldenstein) |
|
@codex review this |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3bcbe766c3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review again |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
Root cause
The scanner finding was a bundle-level false positive rather than an observed secret dataflow:
dist/index.jscombined unrelatedprocess.envreads with the auto-update service's fixed public npm registry request. Keeping both capabilities in one generated file made that distinction impossible for the file-level scanner.Impact
Auto-update discovery continues to query the same fixed npm registry endpoint with the same timeout and response validation. The generated npm client chunk has network access but no environment access; environment-aware chunks have no direct network send.
Validation
pnpm test:file tests/auto-update.test.ts tests/plugin-security-check.test.tspnpm verifypnpm check-plugin-securitypnpm audit --prodgit diff --checkpnpm packcontents fordist/index.jsand all required chunks