@cline/core — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

beatrix-clinebarreirotarakhansaoudcline

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
typosquat	typosquat.levenshtein:cors	AI (typosquat): @cline/core is a scoped package from the official Cline AI project, not a typosquat of cors.	ai	2026/05/26
phantom-deps	phantom-dep:ws	AI (phantom-deps): ws is declared in package.json and used in the bundled dist; heuristic false positive for this package.	ai	2026/05/26
phantom-deps	phantom-dep:yaml	AI (phantom-deps): yaml is declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:nanoid	AI (phantom-deps): nanoid is declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:simple-git	AI (phantom-deps): simple-git is declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:node-machine-id	AI (phantom-deps): node-machine-id is declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/api-logs	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/resources	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/sdk-trace-base	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/semantic-conventions	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/exporter-logs-otlp-http	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/exporter-trace-otlp-http	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26
phantom-deps	phantom-dep:@opentelemetry/exporter-metrics-otlp-http	AI (phantom-deps): OpenTelemetry deps are declared in package.json; phantom-dep heuristic fires on bundled/re-exported usage.	ai	2026/05/26

Versions (showing 3 of 3)

Version	Deps	Published
0.0.41	22 / 1	2026-05-13
0.0.40	22 / 1	2026-05-13
0.0.39	21 / 1	2026-05-09

v0.0.41

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@cline/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.40

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@cline/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.0.39

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@cline/core' is 1 edit(s) away from popular package 'cors'.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.