@datocms/cli
Legacy scoped alias for the `datocms` package
36
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
marcelofinamorvieirastefanovernadelphabermat_jack1souljusesistrall_datoroger
Keywords
datocmscli
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Passes process.env to subprocess runner with API token override — standard CLI subprocess invocation pattern. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-plugins | AI (phantom-deps): oclif plugins are declared in oclif config block, not imported directly — standard oclif pattern. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-not-found | AI (phantom-deps): oclif plugins are declared in oclif config block, not imported directly — standard oclif pattern. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-autocomplete | AI (phantom-deps): oclif plugins are declared in oclif config block, not imported directly — standard oclif pattern. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-warn-if-update-available | AI (phantom-deps): oclif plugins are declared in oclif config block, not imported directly — standard oclif pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in CMA call helper resolves internal resource paths; consistent with oclif CLI plugin loading pattern. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-help | AI (phantom-deps): oclif plugins are declared in oclif config block, not imported directly — standard oclif pattern. | ai | |
| phantom-deps | phantom-dep:@oclif/core | AI (phantom-deps): @oclif/core is a declared dependency used via oclif config, not direct import; stable false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @datocms/cli is a legitimate DatoCMS org package, not a typosquat of joi. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Intentionally minimal wrapper/alias package in a monorepo; empty main is by design. | ai |
Versions (showing 36 of 36)
| Version | Deps | Published |
|---|---|---|
| 4.0.28 | 2 / 0 | |
| 4.0.27 | 2 / 0 | |
| 4.0.26 | 2 / 0 | |
| 4.0.25 | 2 / 0 | |
| 4.0.24 | 2 / 0 | |
| 4.0.23 | 2 / 0 | |
| 4.0.22 | 2 / 0 | |
| 4.0.21 | 2 / 0 | |
| 4.0.20 | 2 / 0 | |
| 4.0.19 | 2 / 0 | |
| 4.0.18 | 2 / 0 | |
| 4.0.17 | 2 / 0 | |
| 4.0.16 | 2 / 0 | |
| 4.0.15 | 2 / 0 | |
| 4.0.14 | 2 / 0 | |
| 4.0.13 | 2 / 0 | |
| 4.0.12 | 2 / 0 | |
| 4.0.10 | 18 / 5 | |
| 4.0.9 | 18 / 5 | |
| 4.0.8 | 18 / 5 | |
| 4.0.7 | 18 / 5 | |
| 4.0.6 | 18 / 5 | |
| 4.0.5 | 17 / 5 | |
| 4.0.4 | 16 / 5 | |
| 4.0.3 | 16 / 5 | |
| 4.0.2 | 16 / 5 | |
| 4.0.1 | 16 / 5 | |
| 4.0.0 | 16 / 5 | |
| 3.1.15 | 14 / 5 | |
| 3.1.14 | 14 / 5 | |
| 3.1.13 | 14 / 5 | |
| 3.1.12 | 14 / 5 | |
| 3.1.11 | 13 / 5 | |
| 3.1.10 | 13 / 5 | |
| 3.1.9 | 13 / 5 | |
| 3.1.8 | 13 / 5 |
v4.0.28
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.