@alwaysmeticulous/cli
The Meticulous CLI
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@alwaysmeticulous/session-filters | AI (dependencies): First-party monorepo dep: same org/maintainer/repo, version-locked to package version. | ai | |
| provenance | regressed-provenance | AI (provenance): Manual publish by known maintainer meticulous.eng (listed on prior approved versions); no malicious code corroborates compromise. | ai | |
| phantom-deps | phantom-dep:@alwaysmeticulous/session-filters | AI (phantom-deps): Same-org monorepo alignment dep not directly imported; benign. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): puppeteer-core is a well-known Google-maintained package; appropriate for a browser replay/automation CLI. | ai | |
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation; missing gitHead is a minor metadata gap, not a supply chain risk for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Transition to GitHub Actions publishing makes individual maintainer accounts redundant; consistent with CI automation. | ai | |
| provenance | publisher-changed | AI (provenance): Package publishes via GitHub Actions CI with SLSA attestation; this is the documented automated release pattern. | ai | |
| dependencies | unvetted-dep:@alwaysmeticulous/replay-orchestrator-launcher | AI (dependencies): First-party monorepo dep from the same publisher; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@alwaysmeticulous/remote-replay-launcher | AI (dependencies): First-party monorepo dep from the same publisher; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@alwaysmeticulous/client | AI (dependencies): First-party monorepo dep from the same publisher; stable pattern across all versions. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @alwaysmeticulous namespace; levenshtein match to 'joi' is a false positive for this established package. | ai |
Versions (showing 51 of 326)
| Version | Deps | Published |
|---|---|---|
| 2.313.1 | 23 / 5 | |
| 2.312.0 | 23 / 5 | |
| 2.311.0 | 23 / 5 | |
| 2.309.0 | 23 / 5 | |
| 2.308.0 | 23 / 5 | |
| 2.307.0 | 23 / 5 | |
| 2.306.0 | 23 / 5 | |
| 2.305.0 | 22 / 5 | |
| 2.304.0 | 22 / 5 | |
| 2.303.1 | 22 / 5 | |
| 2.303.0 | 22 / 5 | |
| 2.300.0 | 22 / 5 | |
| 2.299.0 | 22 / 5 | |
| 2.298.1 | 22 / 5 | |
| 2.298.0 | 22 / 5 | |
| 2.297.1 | 22 / 5 | |
| 2.297.0 | 22 / 5 | |
| 2.296.0 | 22 / 5 | |
| 2.295.1 | 22 / 5 | |
| 2.295.0 | 22 / 5 | |
| 2.294.0 | 22 / 5 | |
| 2.293.1 | 22 / 5 | |
| 2.293.0 | 22 / 5 | |
| 2.292.1 | 22 / 5 | |
| 2.292.0 | 22 / 5 | |
| 2.291.2 | 22 / 5 | |
| 2.291.1 | 22 / 5 | |
| 2.291.0 | 22 / 5 | |
| 2.290.3 | 22 / 5 | |
| 2.290.2 | 22 / 5 | |
| 2.290.0 | 22 / 5 | |
| 2.289.2 | 22 / 5 | |
| 2.289.1 | 22 / 5 | |
| 2.289.0 | 22 / 5 | |
| 2.288.2 | 22 / 5 | |
| 2.288.1 | 22 / 5 | |
| 2.288.0 | 22 / 5 | |
| 2.287.2 | 22 / 5 | |
| 2.287.1 | 22 / 5 | |
| 2.287.0 | 22 / 5 | |
| 2.286.0 | 22 / 5 | |
| 2.285.2 | 22 / 5 | |
| 2.285.1 | 22 / 5 | |
| 2.285.0 | 22 / 5 | |
| 2.284.0 | 22 / 5 | |
| 2.283.2 | 22 / 5 | |
| 2.283.1 | 22 / 5 | |
| 2.283.0 | 22 / 5 | |
| 2.282.0 | 22 / 5 | |
| 2.281.0 | 22 / 5 | |
| 2.280.1 | 22 / 5 |
v2.313.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.312.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.311.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.309.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.308.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-07-13. This could indicate a legitimate maintainer transition or an account compromise.
v2.307.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-07-13. This could indicate a legitimate maintainer transition or an account compromise.
v2.306.0
2 findingsThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
This version was published by a different npm account (meticulous.eng) than the most recent previously approved version (GitHub Actions) on 2026-07-08, but meticulous.eng is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.305.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.304.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.303.1
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.303.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.300.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.