@constructive-io/cli
Constructive CLI
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): CLI deployment tool intentionally passes env vars to child processes; env-spread is expected behavior here. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI tool legitimately uses child_process for deployment commands; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:pg-env | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:shelljs | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@pgpmjs/types | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@pgpmjs/server-utils | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:find-and-require-package-json | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@pgpmjs/core | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:pgpm | AI (phantom-deps): CLI tool; deps referenced in config files, not direct imports — stable pattern for this package. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @constructive-io/cli vs 'joi' is a false positive; edit-distance comparison across scoped names is meaningless here. | ai | |
| phantom-deps | phantom-dep:@constructive-io/graphql-types | AI (phantom-deps): Same-org dependency; likely used via config/re-export pattern, stable false positive. | ai |
Versions (showing 51 of 327)
| Version | Deps | Published |
|---|---|---|
| 8.4.3 | 19 / 9 | |
| 8.4.2 | 19 / 9 | |
| 8.4.1 | 19 / 9 | |
| 8.4.0 | 19 / 9 | |
| 8.3.3 | 19 / 9 | |
| 8.3.2 | 19 / 9 | |
| 8.1.1 | 19 / 9 | |
| 8.1.0 | 19 / 9 | |
| 8.0.4 | 20 / 9 | |
| 8.0.3 | 20 / 9 | |
| 8.0.2 | 20 / 9 | |
| 8.0.1 | 20 / 9 | |
| 8.0.0 | 20 / 9 | |
| 7.30.9 | 20 / 9 | |
| 7.30.8 | 20 / 9 | |
| 7.30.7 | 20 / 9 | |
| 7.30.6 | 20 / 9 | |
| 7.30.5 | 20 / 9 | |
| 7.30.4 | 20 / 9 | |
| 7.30.3 | 20 / 9 | |
| 7.30.2 | 20 / 9 | |
| 7.30.1 | 20 / 9 | |
| 7.30.0 | 20 / 9 | |
| 7.29.3 | 20 / 9 | |
| 7.29.2 | 20 / 9 | |
| 7.29.1 | 20 / 9 | |
| 7.29.0 | 20 / 9 | |
| 7.28.3 | 20 / 9 | |
| 7.28.2 | 20 / 9 | |
| 7.28.1 | 20 / 9 | |
| 7.28.0 | 20 / 9 | |
| 7.27.12 | 20 / 9 | |
| 7.27.11 | 20 / 9 | |
| 7.27.10 | 20 / 9 | |
| 7.27.9 | 20 / 9 | |
| 7.27.8 | 20 / 9 | |
| 7.27.7 | 20 / 9 | |
| 7.27.6 | 20 / 9 | |
| 7.27.5 | 20 / 9 | |
| 7.27.4 | 20 / 9 | |
| 7.27.3 | 20 / 9 | |
| 7.27.2 | 20 / 9 | |
| 7.27.1 | 20 / 9 | |
| 7.27.0 | 20 / 9 | |
| 7.26.0 | 20 / 9 | |
| 7.25.0 | 20 / 9 | |
| 7.24.0 | 20 / 9 | |
| 7.23.20 | 20 / 9 | |
| 7.23.19 | 20 / 9 | |
| 7.23.18 | 20 / 9 | |
| 7.23.17 | 20 / 9 |
v8.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.30.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.29.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.28.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.27.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.26.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v7.25.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.