← Home

@clinebot/llms

npm
29
Versions
—
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

johnsimbotsaoudclinebeatrix-clinebarreirotmaxpaulusarakhan

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata suspicious-initial-version AI (npm-metadata): Monorepo workspace package using 0.0.0 as a placeholder version; 34 published versions confirm legitimate project. ai
semgrep semgrep:base64-decode AI (semgrep): Decoding image data from Bedrock API responses; standard multimodal provider pattern, not a payload risk. ai
phantom-deps phantom-dep:@ai-sdk/openai AI (phantom-deps): Provider plugin pattern; loaded by convention. ai
phantom-deps phantom-dep:@ai-sdk/anthropic AI (phantom-deps): Provider plugin pattern; loaded by convention. ai
phantom-deps phantom-dep:ai AI (phantom-deps): Config-driven provider SDK; deps loaded by convention, not direct import. ai
phantom-deps phantom-dep:@ai-sdk/google-vertex AI (phantom-deps): Provider plugin pattern; loaded by convention. ai
phantom-deps phantom-dep:@ai-sdk/openai-compatible AI (phantom-deps): Provider plugin pattern; loaded by convention. ai
phantom-deps phantom-dep:@ai-sdk/google AI (phantom-deps): Provider plugin pattern; loaded by convention. ai
phantom-deps phantom-dep:nanoid AI (phantom-deps): Config-driven provider library; deps loaded by convention, not direct import. ai
phantom-deps phantom-dep:@aws-sdk/credential-providers AI (phantom-deps): Framework-scoped AWS credential package; loaded by convention as noted by analyzer. ai
phantom-deps phantom-dep:@ai-sdk/mistral AI (phantom-deps): Provider loaded by convention in config-driven architecture. ai
phantom-deps phantom-dep:dify-ai-provider AI (phantom-deps): Provider loaded by convention in config-driven architecture. ai
phantom-deps phantom-dep:@streamparser/json AI (phantom-deps): Utility dep used indirectly; consistent with config-driven provider pattern. ai
phantom-deps phantom-dep:@ai-sdk/amazon-bedrock AI (phantom-deps): Provider loaded by convention in config-driven architecture. ai
phantom-deps phantom-dep:ai-sdk-provider-codex-cli AI (phantom-deps): Provider loaded by convention in config-driven architecture. ai
phantom-deps phantom-dep:ai-sdk-provider-claude-code AI (phantom-deps): Provider loaded by convention in config-driven architecture. ai
phantom-deps phantom-dep:ai-sdk-provider-opencode-sdk AI (phantom-deps): Provider loaded by convention in config-driven architecture. ai

Versions (showing 29 of 29)

Version Deps Published
0.0.33 20 / 0
0.0.32 20 / 0
0.0.30 20 / 0
0.0.29 20 / 0
0.0.28 17 / 0
0.0.27 17 / 0
0.0.26 17 / 0
0.0.25 17 / 0
0.0.24 16 / 0
0.0.23 16 / 0
0.0.22 16 / 0
0.0.21 16 / 0
0.0.20 16 / 0
0.0.18 16 / 0
0.0.16 16 / 0
0.0.15 16 / 0
0.0.14 16 / 0
0.0.13 16 / 0
0.0.12 16 / 0
0.0.11 16 / 0
0.0.10 16 / 0
0.0.7 15 / 0
0.0.6 15 / 0
0.0.5 15 / 0
0.0.4 15 / 0
0.0.3 15 / 0
0.0.2 15 / 0
0.0.1 16 / 0
0.0.0 16 / 0

v0.0.33

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.28

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.27

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.25

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.24

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.10

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.