@better-webhook/cli
Modern CLI for developing, capturing, and replaying webhooks locally with dashboard UI.
17
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
endalk200
Keywords
webhookclideveloper-toolstestinghttpstripegithubwebhookscapturereplaydashboard
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/dashboard/assets/index-BSfTbn4Y.js | AI (source-diff): Vite-bundled React dashboard asset; minified frontend code, not obfuscation. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/dashboard/assets/index-CZZLwai4.js | AI (source-diff): Standard Vite-bundled React dashboard asset; minified but not obfuscated — sample shows normal React runtime patterns. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI/CD publishing with SLSA provenance attestation; legitimate automation pattern. | ai | |
| source-diff | obfuscated-file:dist/dashboard/assets/index-Dlqdzwyc.js | AI (source-diff): Vite-bundled React dashboard asset; minified frontend bundle, not obfuscated malware. Stable pattern for this package. | ai | |
| source-diff | obfuscated-file:dist/dashboard/assets/index-Mir6leOJ.js | AI (source-diff): Vite-minified React dashboard bundle; expected artifact for a CLI with embedded dashboard UI. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Tiny payload is expected for a binary wrapper shim; README brevity is consistent with a sub-package in a monorepo. | ai | |
| email-domain | unclaimed-email:endalk200 | AI (email-domain): Author field uses GitHub handle as email placeholder, not a real domain; repo and SLSA provenance confirm legitimate publisher. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): 0.0.0 is the intentional initial version of a new wrapper sub-package in an established monorepo with 23 versions and SLSA provenance. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Size drop reflects intentional refactor to a thin npm wrapper delegating to platform-specific optional dep packages. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped webhook CLI package; Levenshtein match to joi is a false positive with no semantic or functional similarity. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): chalk is a declared runtime dep in a bundled CLI; phantom-dep heuristic unreliable for bundled packages. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): ora is a declared runtime dep in a bundled CLI; phantom-dep heuristic unreliable for bundled packages. | ai |