@coveo/cli
Coveo CLI
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Passes process.env to subprocess for CLI scaffolding — standard pattern for this CLI tool. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 is localhost OAuth redirect URI — not a remote raw IP, safe by design. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads the package's own package.json via resolved path — not arbitrary module loading. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @coveo/cli is a scoped package from the Coveo org, not a typosquat of joi. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-help | AI (phantom-deps): Declared as oclif plugin in oclif config — not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-plugins | AI (phantom-deps): Declared as oclif plugin in oclif config — not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-version | AI (phantom-deps): Declared as oclif plugin in oclif config — not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@coveo/cli-plugin-source | AI (phantom-deps): Declared as oclif plugin in oclif config — same org scope, not a direct import by design. | ai | |
| phantom-deps | phantom-dep:cli-progress | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:node-machine-id | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:isomorphic-fetch | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:https-proxy-agent | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:@amplitude/identify | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:is-unicode-supported | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:abortcontroller-polyfill | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:@amplitude/analytics-node | AI (phantom-deps): Referenced in config files; stable false positive for this CLI package. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 3.2.14 | 31 / 38 |
v3.2.14
2 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/coveo/cli/blob/d43da585b69a774fe2ff77d70dec0ad5b35fdf3b/lib/commands/ui/create/react.js#L40 38 | await (0, process_1.spawnProcessOutput)((0, os_1.appendCmdIfWindows) `npm`, ['run', 'setup-env'], { 39 | cwd: name, > 40 | env: { ...process.env, ...env }, 41 | }); 42 | }
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.