← Home

@anthropic-ai/claude-code

npm Homepage

Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you.

51
Versions
SEE LICENSE IN README.md
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

zak-anthropicdylanc-anthropicbenjmannnikhil-anthropicejlangev-antjv-anthropicollie-ant-2025packy-anthropicnoahz-anthropicsbidasariawolffiexfelixrieseberg-anthropicjoan-anthropic

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Anthropic org package with strong publisher track record; maintainer rotation is expected at this scale. ai
source-diff encoded-string-file:cli.js AI (source-diff): cli.js is a minified bundle; 'encoded strings' are inline shell scripts for terminal/environment detection, standard for this CLI tool. Stable FP. ai
npm-metadata bundled-binaries AI (npm-metadata): Bundled ripgrep and audio-capture binaries are expected for this cross-platform CLI tool; stable across versions. ai
provenance no-provenance AI (provenance): Published under verified @anthropic-ai scope with consistent publisher; lack of Sigstore provenance is not a risk signal here. ai
license uncommon-license:SEE LICENSE IN README.md AI (license): Commercial product with custom license terms referenced in README; standard for Anthropic's products. ai
publish-pattern dormant-publish AI (publish-pattern): Official Anthropic CLI package with 387 versions and strong publisher track record; dormancy gaps are expected for a commercial product with irregular release cadence. ai
semgrep semgrep:child-process-import AI (semgrep): child_process/spawnSync is used to invoke the platform-specific Claude binary with stdio:inherit — expected behavior for a CLI wrapper package. ai
semgrep semgrep:env-spread AI (semgrep): cli-wrapper.cjs spreads process.env to pass user environment to the spawned CLI binary — required for a transparent CLI wrapper, not exfiltration. ai
install-scripts install-script:postinstall AI (install-scripts): Postinstall runs node install.cjs to select the correct platform-specific binary from optional dependencies — standard native binary distribution pattern for this package. ai

Versions (showing 51 of 62)

View all versions
Version Deps Published
2.1.220 0 / 0
2.1.219 0 / 0
2.1.163 0 / 0
2.1.161 0 / 0
2.1.160 0 / 0
2.1.157 0 / 0
2.1.149 0 / 0
2.1.148 0 / 0
2.1.146 0 / 0
2.1.145 0 / 0
2.1.144 0 / 0
2.1.143 0 / 0
2.1.142 0 / 0
2.1.141 0 / 0
2.1.140 0 / 0
2.1.139 0 / 0
2.1.137 0 / 0
2.1.136 0 / 0
2.1.133 0 / 0
2.1.132 0 / 0
2.1.131 0 / 0
2.1.128 0 / 0
2.1.126 0 / 0
2.1.124 0 / 0
2.1.123 0 / 0
2.1.120 0 / 0
2.1.119 0 / 0
2.1.118 0 / 0
2.1.117 0 / 0
2.1.116 0 / 0
2.1.114 0 / 0
2.1.113 0 / 0
2.1.112 0 / 0
2.1.111 0 / 0
2.1.110 0 / 0
2.1.109 0 / 0
2.1.108 0 / 0
2.1.107 0 / 0
2.1.105 0 / 0
2.1.104 0 / 0
2.1.101 0 / 0
2.1.100 0 / 0
2.1.98 0 / 0
2.1.97 0 / 0
2.1.96 0 / 0
2.1.94 0 / 0
2.1.92 0 / 0
2.1.91 0 / 0
2.1.90 0 / 0
2.1.89 0 / 0
2.1.87 0 / 0

v2.1.220

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.1.219

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.