@backstage/cli-module-lint
5
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
patrikofrebenmarcuseide
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:cleye | AI (dependencies): cleye is a legitimate CLI argument parsing library; its use is appropriate and expected in a CLI module package from the Backstage monorepo. | ai | |
| dependencies | unvetted-dep:eslint-formatter-friendly | AI (dependencies): eslint-formatter-friendly is a well-known ESLint output formatter; its use is appropriate in a linting CLI module. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo package from the official Backstage project; short README and no keywords are expected for internal CLI tooling packages. | ai | |
| provenance | no-provenance | AI (provenance): Backstage packages historically do not publish with Sigstore provenance; this is consistent across the ecosystem and not a risk indicator. | ai | |
| phantom-deps | phantom-dep:eslint-formatter-friendly | AI (phantom-deps): eslint-formatter-friendly is a runtime dep used via ESLint config, not direct import; this pattern is normal for formatter plugins. | ai |
Versions (showing 5 of 5)
| Version | Deps | Published |
|---|---|---|
| 0.1.4 | 9 / 3 | |
| 0.1.3 | 9 / 3 | |
| 0.1.2 | 9 / 3 | |
| 0.1.1 | 9 / 3 | |
| 0.1.0 | 9 / 3 |
v0.1.4
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.