@cli-forge-bin/spec-forge-cli-darwin-arm64 MIT 2 versions

@cli-forge-bin/spec-forge-cli-darwin-arm64

npm Repository Homepage

darwin-arm64 binary for spec-forge-cli

Versions

MIT

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

byteland-technology

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Platform-specific binary distribution package; SLSA provenance attestation confirms CI/CD build integrity.	ai	2026/04/30
bogus-package	bogus-package	AI (bogus-package): Binary-only platform sub-package legitimately has no deps, no keywords, and minimal README.	ai	2026/04/30

Version	Deps	Published
1.0.1	0 / 0	2026-04-27
1.0.0	0 / 0	2026-04-28

2 findings

HIGH Bundled binary files (1) npm-metadata

Package contains compiled binaries that could be backdoors: • bin/spec-forge-cli

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.