@angular/cli
CLI tool for Angular
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): zod and @modelcontextprotocol/sdk are established, legitimate packages added intentionally for Angular CLI's MCP server feature in v20.1.0. No malicious signal. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Angular CLI regularly adds new source files with major/minor version bumps; 26 new files in a .3.0 release is consistent with active feature development (e.g., MCP tooling). | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): @angular/cli legitimately uses child_process to spawn build subprocesses and local CLI versions. This is expected, documented behavior for a CLI tool. | ai | |
| source-diff | net-exec-file:src/utilities/load-esm.js | AI (source-diff): Well-documented TypeScript workaround using new Function for dynamic import(); no actual network call. Standard Angular CLI pattern. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function used solely to preserve dynamic import() from TS downleveling; documented workaround in Angular CLI. | ai | |
| provenance | no-provenance | AI (provenance): Google-published Angular packages currently lack provenance; not a security concern given publisher trust level. | ai | |
| phantom-deps | phantom-dep:@schematics/angular | AI (phantom-deps): @schematics/angular is referenced in ng-update config for migrations, not directly imported in JS — expected pattern for Angular CLI. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @angular/cli has no relationship to joi; Levenshtein distance match is a structural false positive for long scoped names. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require of project-local CLI is Angular CLI's documented version-resolution mechanism; stable and intentional. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into child process spawn options is standard practice in CLI tools for passing environment context. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): AES-256-GCM decryption protects a read-only Algolia search API key for Angular docs; not malicious payload hiding. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Enumerating process.env for npm proxy/registry config is standard in package management tooling. | ai |
Versions (showing 51 of 187)
| Version | Deps | Published |
|---|---|---|
| 22.0.8 | 18 / 0 | |
| 22.0.7 | 18 / 0 | |
| 22.0.6 | 18 / 0 | |
| 22.0.5 | 18 / 0 | |
| 22.0.4 | 18 / 0 | |
| 22.0.3 | 18 / 0 | |
| 22.0.2 | 18 / 0 | |
| 22.0.1 | 18 / 0 | |
| 22.0.0 | 18 / 0 | |
| 21.2.19 | 18 / 0 | |
| 21.2.18 | 18 / 0 | |
| 21.2.17 | 18 / 0 | |
| 21.2.16 | 18 / 0 | |
| 21.2.15 | 18 / 0 | |
| 21.2.14 | 18 / 0 | |
| 21.2.13 | 18 / 0 | |
| 21.2.12 | 18 / 0 | |
| 21.2.11 | 18 / 0 | |
| 21.2.10 | 18 / 0 | |
| 21.2.9 | 18 / 0 | |
| 21.2.8 | 18 / 0 | |
| 21.2.7 | 18 / 0 | |
| 21.2.6 | 18 / 0 | |
| 21.2.5 | 18 / 0 | |
| 21.2.4 | 18 / 0 | |
| 21.2.3 | 18 / 0 | |
| 21.2.2 | 18 / 0 | |
| 21.2.1 | 18 / 0 | |
| 21.2.0 | 18 / 0 | |
| 21.1.5 | 19 / 0 | |
| 21.1.4 | 19 / 0 | |
| 21.1.3 | 19 / 0 | |
| 21.1.2 | 19 / 0 | |
| 21.1.1 | 19 / 0 | |
| 21.1.0 | 19 / 0 | |
| 21.0.6 | 19 / 0 | |
| 21.0.5 | 19 / 0 | |
| 21.0.4 | 19 / 0 | |
| 21.0.3 | 19 / 0 | |
| 21.0.2 | 19 / 0 | |
| 21.0.1 | 19 / 0 | |
| 21.0.0 | 19 / 0 | |
| 20.3.32 | 18 / 0 | |
| 20.3.31 | 18 / 0 | |
| 20.3.30 | 18 / 0 | |
| 20.3.29 | 18 / 0 | |
| 20.3.28 | 18 / 0 | |
| 20.3.27 | 18 / 0 | |
| 20.3.26 | 18 / 0 | |
| 20.3.25 | 18 / 0 | |
| 20.3.24 | 18 / 0 |
v22.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v22.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.3.32
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.3.31
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.