@backstage/cli
CLI for developing Backstage plugins and apps
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@types/webpack-node-externals | AI (phantom-deps): Framework-scoped type package; stable for build-tool context. | ai | |
| phantom-deps | phantom-dep:@types/start-server-webpack-plugin | AI (phantom-deps): Framework-scoped type package; stable for build-tool context. | ai | |
| phantom-deps | phantom-dep:file-loader | AI (phantom-deps): Webpack loader referenced by generated config, not static import. | ai | |
| dependencies | unvetted-dep:eslint-plugin-monorepo | AI (dependencies): Lint tooling used by CLI-generated eslint configs. | ai | |
| dependencies | unvetted-dep:jest-esm-transformer | AI (dependencies): Standard test tooling dep for CLI's generated jest config. | ai | |
| phantom-deps | phantom-dep:rollup-plugin-typescript2 | AI (phantom-deps): Rollup plugin used via generated build config. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-monorepo | AI (phantom-deps): Lint plugin referenced in generated eslint config, not source imports. | ai | |
| phantom-deps | phantom-dep:@hot-loader/react-dom | AI (phantom-deps): React dev-mode dependency injected via webpack alias. | ai | |
| phantom-deps | phantom-dep:replace-in-file | AI (phantom-deps): Utility used in CLI subcommands, not top-level import. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Core compiler dep for a TS CLI, loaded dynamically. | ai | |
| phantom-deps | phantom-dep:ts-loader | AI (phantom-deps): Webpack loader referenced via generated build configs. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Standard watch dependency for a build CLI. | ai | |
| phantom-deps | phantom-dep:dashify | AI (phantom-deps): Used by generated project configs, not the CLI's own source. | ai | |
| dependencies | unvetted-dep:start-server-webpack-plugin | AI (dependencies): Standard webpack dev-server plugin for CLI's build pipeline. | ai | |
| dependencies | unvetted-dep:@types/start-server-webpack-plugin | AI (dependencies): Type defs paired with the webpack plugin above. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): CLI tool; deps referenced via config/runtime loading, not direct imports. | ai | |
| dependencies | unvetted-dep:@octokit/graphql-schema | AI (dependencies): Official Octokit org package providing GitHub GraphQL schema types; expected dependency for Backstage CLI's GitHub integration. | ai | |
| phantom-deps | phantom-dep:@backstage/types | AI (phantom-deps): Same-org package used via config convention, not direct import; stable for this package. | ai | |
| phantom-deps | phantom-dep:@sucrase/webpack-loader | AI (phantom-deps): Config-referenced webpack loader; stable CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:@octokit/graphql-schema | AI (phantom-deps): Config-referenced dep; stable CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:terser-webpack-plugin | AI (phantom-deps): Config-referenced webpack plugin; stable CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:@octokit/oauth-app | AI (phantom-deps): Config-referenced dep; stable CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:@svgr/plugin-svgo | AI (phantom-deps): Config-referenced SVGR plugin; stable CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:@svgr/plugin-jsx | AI (phantom-deps): Config-referenced SVGR plugin; stable CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:@octokit/graphql | AI (phantom-deps): Referenced in config files; consistent with CLI tool pattern. | ai | |
| phantom-deps | phantom-dep:@svgr/core | AI (phantom-deps): CLI tool references deps via webpack/rollup config files, not direct imports; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@spotify/eslint-config-react | AI (phantom-deps): Referenced in ESLint config files; expected for this CLI. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): Established templating library; standard dep for Backstage CLI scaffolding. | ai | |
| dependencies | unvetted-dep:replace-in-file | AI (dependencies): Common file-manipulation utility; expected in a CLI tool. | ai | |
| dependencies | unvetted-dep:jest-css-modules | AI (dependencies): Jest transform helper; expected in a CLI that configures Jest. | ai | |
| dependencies | unvetted-dep:eslint-formatter-friendly | AI (dependencies): ESLint formatter; expected in a CLI that bundles ESLint config. | ai | |
| dependencies | unvetted-dep:eslint-plugin-deprecation | AI (dependencies): ESLint plugin; expected in a CLI that bundles ESLint config. | ai | |
| dependencies | unvetted-dep:@spotify/eslint-config-base | AI (dependencies): Spotify ESLint config; standard dep for Backstage CLI. | ai | |
| dependencies | unvetted-dep:@backstage/release-manifests | AI (dependencies): Same-org Backstage package; expected internal dep. | ai | |
| dependencies | unvetted-dep:@spotify/eslint-config-react | AI (dependencies): Spotify ESLint config; standard dep for Backstage CLI. | ai | |
| dependencies | unvetted-dep:@spotify/eslint-config-typescript | AI (dependencies): Spotify ESLint config; standard dep for Backstage CLI. | ai | |
| phantom-deps | phantom-dep:jest | AI (phantom-deps): CLI configures Jest; referenced in config files by design. | ai | |
| phantom-deps | phantom-dep:jest-cli | AI (phantom-deps): CLI configures Jest; referenced in config files by design. | ai | |
| phantom-deps | phantom-dep:@types/jest | AI (phantom-deps): Type package loaded by convention in Jest-configuring CLI. | ai | |
| phantom-deps | phantom-dep:json-schema | AI (phantom-deps): Referenced in config files; stable false positive for this CLI. | ai | |
| phantom-deps | phantom-dep:eslint-formatter-friendly | AI (phantom-deps): Referenced in ESLint config files; expected for this CLI. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-unused-imports | AI (phantom-deps): Referenced in ESLint config files; expected for this CLI. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/eslint-plugin | AI (phantom-deps): Referenced in ESLint config files; expected for this CLI. | ai | |
| phantom-deps | phantom-dep:@spotify/eslint-config-typescript | AI (phantom-deps): Referenced in ESLint config files; expected for this CLI. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): ESLint is a peer/config dep for this CLI; stable FP. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): CLI tooling; glob referenced in config files, not direct imports — stable FP for this package. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-react-hooks | AI (phantom-deps): ESLint plugin referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:@spotify/eslint-config-base | AI (phantom-deps): ESLint config referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:sucrase | AI (phantom-deps): Referenced in config files; stable FP for this CLI package. | ai | |
| phantom-deps | phantom-dep:pirates | AI (phantom-deps): Used transitively via sucrase/config; stable FP for this CLI. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): Referenced in config files; stable FP for this CLI package. | ai | |
| phantom-deps | phantom-dep:@manypkg/get-packages | AI (phantom-deps): Monorepo tooling dep referenced in config; stable FP. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-import | AI (phantom-deps): ESLint plugin referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-react | AI (phantom-deps): ESLint plugin referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-jest | AI (phantom-deps): ESLint plugin referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:@types/webpack-env | AI (phantom-deps): Type-only dep loaded by convention; stable FP. | ai | |
| phantom-deps | phantom-dep:jest-css-modules | AI (phantom-deps): Jest config dep; stable FP for this CLI package. | ai | |
| phantom-deps | phantom-dep:cross-fetch | AI (phantom-deps): Utility dep referenced in config; stable FP for this CLI. | ai | |
| phantom-deps | phantom-dep:@swc/jest | AI (phantom-deps): Jest transform dep referenced in config; stable FP. | ai | |
| phantom-deps | phantom-dep:@swc/core | AI (phantom-deps): SWC is a build/test tool dep referenced in config; stable FP. | ai | |
| phantom-deps | phantom-dep:eslint-config-prettier | AI (phantom-deps): ESLint config referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-jsx-a11y | AI (phantom-deps): ESLint plugin referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/parser | AI (phantom-deps): ESLint parser referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:eslint-plugin-deprecation | AI (phantom-deps): ESLint plugin referenced in config files; stable FP. | ai | |
| phantom-deps | phantom-dep:@backstage/eslint-plugin | AI (phantom-deps): Same-org package; phantom detection is a false positive for intra-monorepo dependencies. | ai | |
| phantom-deps | phantom-dep:@backstage/catalog-model | AI (phantom-deps): Same-org package; phantom detection is a false positive for intra-monorepo dependencies. | ai | |
| phantom-deps | phantom-dep:@backstage/integration | AI (phantom-deps): Same-org package; phantom detection is a false positive for intra-monorepo dependencies. | ai | |
| phantom-deps | phantom-dep:global-agent | AI (phantom-deps): Referenced in config files for proxy support; expected for a CLI tool. | ai | |
| phantom-deps | phantom-dep:git-url-parse | AI (phantom-deps): Referenced in config files; expected for a CLI that handles git repository operations. | ai | |
| provenance | no-provenance | AI (provenance): Backstage CLI is a well-established package from the official backstage/backstage monorepo; lack of provenance is acceptable given its age and ecosystem standing. | ai | |
| phantom-deps | phantom-dep:undici | AI (phantom-deps): undici is a known implicit/runtime dependency; expected for a CLI making HTTP requests. | ai | |
| phantom-deps | phantom-dep:esbuild | AI (phantom-deps): esbuild is a known implicit/binary dependency for build tooling; analyzer correctly flags as such. | ai | |
| phantom-deps | phantom-dep:postcss | AI (phantom-deps): PostCSS is referenced in build config files; expected for a CLI that handles CSS bundling. | ai | |
| phantom-deps | phantom-dep:buffer | AI (phantom-deps): Buffer is declared as a dependency for browser polyfill use in webpack/rspack configs — expected for a build CLI tool. | ai | |
| phantom-deps | phantom-dep:@swc/helpers | AI (phantom-deps): SWC helpers are a known implicit dependency when using @swc/core for transpilation. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @backstage/cli cannot be a typosquat of unscoped 'joi'; edit-distance comparison across scoped/unscoped namespaces is a false positive for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in eslint-factory.js loads package.json from a user-specified project directory — standard CLI behavior for inspecting project structure, not arbitrary code loading. | ai |
Versions (showing 70 of 70)
| Version | Deps | Published |
|---|---|---|
| 0.36.4 | 33 / 22 | |
| 0.36.3 | 33 / 22 | |
| 0.36.2 | 35 / 22 | |
| 0.36.1 | 35 / 23 | |
| 0.36.0 | 35 / 23 | |
| 0.35.4 | 99 / 47 | |
| 0.35.3 | 97 / 47 | |
| 0.35.2 | 97 / 47 | |
| 0.35.1 | 97 / 47 | |
| 0.35.0 | 97 / 47 | |
| 0.34.6 | 102 / 43 | |
| 0.34.5 | 102 / 43 | |
| 0.34.4 | 102 / 43 | |
| 0.34.3 | 105 / 43 | |
| 0.33.1 | 114 / 38 | |
| 0.32.0 | 114 / 38 | |
| 0.31.1 | 114 / 38 | |
| 0.31.0 | 114 / 38 | |
| 0.30.0 | 114 / 38 | |
| 0.29.6 | 113 / 38 | |
| 0.29.5 | 113 / 38 | |
| 0.29.4 | 113 / 42 | |
| 0.29.3 | 114 / 42 | |
| 0.29.2 | 114 / 42 | |
| 0.29.1 | 114 / 42 | |
| 0.29.0 | 114 / 42 | |
| 0.28.2 | 116 / 43 | |
| 0.28.1 | 116 / 43 | |
| 0.28.0 | 116 / 43 | |
| 0.27.1 | 113 / 33 | |
| 0.27.0 | 112 / 33 | |
| 0.26.11 | 112 / 33 | |
| 0.26.10 | 111 / 33 | |
| 0.26.9 | 111 / 33 | |
| 0.26.8 | 111 / 33 | |
| 0.26.7 | 111 / 33 | |
| 0.26.6 | 111 / 33 | |
| 0.26.5 | 111 / 33 | |
| 0.26.4 | 111 / 33 | |
| 0.26.3 | 110 / 33 | |
| 0.26.2 | 110 / 33 | |
| 0.26.1 | 110 / 33 | |
| 0.26.0 | 110 / 33 | |
| 0.25.2 | 110 / 31 | |
| 0.25.1 | 109 / 31 | |
| 0.25.0 | 109 / 31 | |
| 0.24.0 | 108 / 31 | |
| 0.23.1 | 109 / 31 | |
| 0.23.0 | 109 / 31 | |
| 0.22.14 | 108 / 33 | |
| 0.22.13 | 108 / 33 | |
| 0.22.12 | 107 / 31 | |
| 0.22.11 | 107 / 31 | |
| 0.22.10 | 107 / 31 | |
| 0.22.9 | 107 / 31 | |
| 0.22.8 | 107 / 31 | |
| 0.22.7 | 101 / 31 | |
| 0.22.6 | 101 / 31 | |
| 0.22.5 | 98 / 30 | |
| 0.22.4 | 98 / 30 | |
| 0.22.3 | 98 / 30 | |
| 0.22.2 | 98 / 30 | |
| 0.6.12 | 87 / 27 | |
| 0.6.6 | 86 / 27 | |
| 0.6.4 | 86 / 27 | |
| 0.5.0 | 83 / 27 | |
| 0.4.5 | 81 / 26 | |
| 0.4.1 | 81 / 27 | |
| 0.3.2 | 81 / 27 | |
| 0.1.1 | 78 / 26 |
v0.36.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.32.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.31.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.30.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.29.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.26.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.24.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.23.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.22.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.