@cli-forge-bin/jellyfin-agent-cli-win32-arm64 MIT OR Apache-2.0 2 versions

@cli-forge-bin/jellyfin-agent-cli-win32-arm64

npm Repository Homepage

win32-arm64 binary for jellyfin-agent-cli

Versions

MIT OR Apache-2.0

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

byteland-technology

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Platform binary distribution package; .exe is the intended artifact, published with SLSA provenance attestation.	ai	2026/05/31
bogus-package	bogus-package	AI (bogus-package): Binary-only distribution packages legitimately have no deps, no keywords, and minimal README.	ai	2026/05/31

Version	Deps	Published
1.1.0	0 / 0	2026-05-22
1.0.0	0 / 0	2026-04-28

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • bin/jellyfin-agent-cli.exe

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.