@alwaysmeticulous/cli
The Meticulous CLI
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@alwaysmeticulous/session-filters | AI (dependencies): First-party monorepo dep: same org/maintainer/repo, version-locked to package version. | ai | |
| provenance | regressed-provenance | AI (provenance): Manual publish by known maintainer meticulous.eng (listed on prior approved versions); no malicious code corroborates compromise. | ai | |
| phantom-deps | phantom-dep:@alwaysmeticulous/session-filters | AI (phantom-deps): Same-org monorepo alignment dep not directly imported; benign. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): puppeteer-core is a well-known Google-maintained package; appropriate for a browser replay/automation CLI. | ai | |
| provenance | missing-githead | AI (provenance): Package has SLSA provenance attestation; missing gitHead is a minor metadata gap, not a supply chain risk for this package. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Transition to GitHub Actions publishing makes individual maintainer accounts redundant; consistent with CI automation. | ai | |
| provenance | publisher-changed | AI (provenance): Package publishes via GitHub Actions CI with SLSA attestation; this is the documented automated release pattern. | ai | |
| dependencies | unvetted-dep:@alwaysmeticulous/replay-orchestrator-launcher | AI (dependencies): First-party monorepo dep from the same publisher; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@alwaysmeticulous/remote-replay-launcher | AI (dependencies): First-party monorepo dep from the same publisher; stable pattern across all versions. | ai | |
| dependencies | unvetted-dep:@alwaysmeticulous/client | AI (dependencies): First-party monorepo dep from the same publisher; stable pattern across all versions. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @alwaysmeticulous namespace; levenshtein match to 'joi' is a false positive for this established package. | ai |
Versions (showing 100 of 326)
| Version | Deps | Published |
|---|---|---|
| 2.313.1 | 23 / 5 | |
| 2.312.0 | 23 / 5 | |
| 2.311.0 | 23 / 5 | |
| 2.309.0 | 23 / 5 | |
| 2.308.0 | 23 / 5 | |
| 2.307.0 | 23 / 5 | |
| 2.306.0 | 23 / 5 | |
| 2.305.0 | 22 / 5 | |
| 2.304.0 | 22 / 5 | |
| 2.303.1 | 22 / 5 | |
| 2.303.0 | 22 / 5 | |
| 2.300.0 | 22 / 5 | |
| 2.299.0 | 22 / 5 | |
| 2.298.1 | 22 / 5 | |
| 2.298.0 | 22 / 5 | |
| 2.297.1 | 22 / 5 | |
| 2.297.0 | 22 / 5 | |
| 2.296.0 | 22 / 5 | |
| 2.295.1 | 22 / 5 | |
| 2.295.0 | 22 / 5 | |
| 2.294.0 | 22 / 5 | |
| 2.293.1 | 22 / 5 | |
| 2.293.0 | 22 / 5 | |
| 2.292.1 | 22 / 5 | |
| 2.292.0 | 22 / 5 | |
| 2.291.2 | 22 / 5 | |
| 2.291.1 | 22 / 5 | |
| 2.291.0 | 22 / 5 | |
| 2.290.3 | 22 / 5 | |
| 2.290.2 | 22 / 5 | |
| 2.290.0 | 22 / 5 | |
| 2.289.2 | 22 / 5 | |
| 2.289.1 | 22 / 5 | |
| 2.289.0 | 22 / 5 | |
| 2.288.2 | 22 / 5 | |
| 2.288.1 | 22 / 5 | |
| 2.288.0 | 22 / 5 | |
| 2.287.2 | 22 / 5 | |
| 2.287.1 | 22 / 5 | |
| 2.287.0 | 22 / 5 | |
| 2.286.0 | 22 / 5 | |
| 2.285.2 | 22 / 5 | |
| 2.285.1 | 22 / 5 | |
| 2.285.0 | 22 / 5 | |
| 2.284.0 | 22 / 5 | |
| 2.283.2 | 22 / 5 | |
| 2.283.1 | 22 / 5 | |
| 2.283.0 | 22 / 5 | |
| 2.282.0 | 22 / 5 | |
| 2.281.0 | 22 / 5 | |
| 2.280.1 | 22 / 5 | |
| 2.280.0 | 22 / 5 | |
| 2.279.0 | 21 / 5 | |
| 2.278.0 | 21 / 5 | |
| 2.277.0 | 21 / 5 | |
| 2.276.3 | 21 / 5 | |
| 2.276.2 | 21 / 5 | |
| 2.276.1 | 21 / 5 | |
| 2.276.0 | 21 / 5 | |
| 2.275.1 | 21 / 5 | |
| 2.275.0 | 21 / 5 | |
| 2.274.2 | 21 / 5 | |
| 2.274.1 | 21 / 5 | |
| 2.274.0 | 21 / 5 | |
| 2.273.0 | 21 / 5 | |
| 2.272.0 | 21 / 5 | |
| 2.271.0 | 21 / 5 | |
| 2.270.1 | 21 / 5 | |
| 2.270.0 | 21 / 5 | |
| 2.269.1 | 21 / 5 | |
| 2.269.0 | 21 / 5 | |
| 2.268.0 | 21 / 5 | |
| 2.267.0 | 21 / 5 | |
| 2.266.2 | 21 / 5 | |
| 2.266.1 | 21 / 5 | |
| 2.266.0 | 21 / 5 | |
| 2.265.0 | 21 / 5 | |
| 2.264.6 | 21 / 5 | |
| 2.264.5 | 21 / 5 | |
| 2.264.4 | 21 / 5 | |
| 2.264.3 | 21 / 5 | |
| 2.264.2 | 21 / 5 | |
| 2.264.1 | 21 / 5 | |
| 2.264.0 | 21 / 5 | |
| 2.263.0 | 21 / 5 | |
| 2.262.2 | 21 / 5 | |
| 2.262.1 | 21 / 5 | |
| 2.262.0 | 21 / 5 | |
| 2.261.1 | 21 / 5 | |
| 2.260.2 | 19 / 4 | |
| 2.260.1 | 18 / 4 | |
| 2.260.0 | 18 / 4 | |
| 2.259.0 | 18 / 4 | |
| 2.258.0 | 18 / 4 | |
| 2.257.1 | 18 / 4 | |
| 2.257.0 | 18 / 4 | |
| 2.256.0 | 18 / 4 | |
| 2.255.3 | 18 / 4 | |
| 2.255.2 | 18 / 4 | |
| 2.255.1 | 18 / 4 |
v2.313.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.312.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.311.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.309.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.308.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-07-13. This could indicate a legitimate maintainer transition or an account compromise.
v2.307.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-07-13. This could indicate a legitimate maintainer transition or an account compromise.
v2.306.0
2 findingsThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
This version was published by a different npm account (meticulous.eng) than the most recent previously approved version (GitHub Actions) on 2026-07-08, but meticulous.eng is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v2.305.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.304.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.303.1
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.303.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.
v2.300.0
1 findingThis version was published without provenance, but prior versions were published via CI/CD with attestations. This is a strong signal of a potential account compromise or unauthorized publish. The axios attack (March 2026) exhibited exactly this pattern.