@devvit/cli
Reddit's Dev Platform CLI Tool
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:ps-node | AI (dependencies): ps-node is a legitimate process-listing utility appropriate for a CLI tool; stable dependency across versions. | ai | |
| phantom-deps | phantom-dep:lookpath | AI (phantom-deps): Binary lookup utility used indirectly; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:listr | AI (phantom-deps): CLI task-runner loaded dynamically; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:tsv | AI (phantom-deps): Referenced in config/build context for oclif CLI; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:get-port | AI (phantom-deps): Port utility used indirectly in CLI dev server flow; stable false positive. | ai | |
| phantom-deps | phantom-dep:ps-node | AI (phantom-deps): Process utility used indirectly; consistent with CLI tooling pattern. | ai | |
| dependencies | unvetted-dep:@devvit/play | AI (dependencies): First-party @devvit/* scoped package from the same publisher; consistent with the rest of the dependency tree. | ai | |
| dependencies | unvetted-dep:twirp-ts | AI (dependencies): Stable gRPC/Twirp transport dep used consistently across devvit CLI versions. | ai | |
| dependencies | unvetted-dep:@devvit/build-pack | AI (dependencies): First-party sibling package in the @devvit monorepo; stable pattern across all versions. | ai | |
| provenance | no-provenance | AI (provenance): Established Reddit-owned CLI; lack of Sigstore provenance is consistent across all prior versions. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-warn-if-update-available | AI (phantom-deps): oclif plugins are loaded by convention via oclif config, not direct imports. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-autocomplete | AI (phantom-deps): oclif plugins are loaded by convention via oclif config, not direct imports. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-not-found | AI (phantom-deps): oclif plugins are loaded by convention via oclif config, not direct imports. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @devvit/cli package from Reddit's dev platform; levenshtein match to 'joi' is a false positive. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-help | AI (phantom-deps): oclif plugins are loaded by convention via oclif config, not direct imports. | ai | |
| phantom-deps | phantom-dep:@types/ws | AI (phantom-deps): Type-only package for ws; used at compile time, not directly imported at runtime. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 0.12.24 | 36 / 15 | |
| 0.12.23 | 36 / 15 | |
| 0.12.22 | 36 / 15 | |
| 0.12.21 | 36 / 15 | |
| 0.12.20 | 36 / 15 | |
| 0.12.19 | 36 / 15 | |
| 0.12.18 | 36 / 15 | |
| 0.12.17 | 36 / 15 | |
| 0.12.16 | 36 / 15 | |
| 0.12.15 | 36 / 15 | |
| 0.12.14 | 36 / 15 | |
| 0.12.13 | 34 / 15 | |
| 0.12.8 | 32 / 14 | |
| 0.12.6 | 31 / 14 | |
| 0.12.5 | 31 / 14 | |
| 0.12.3 | 31 / 14 | |
| 0.12.2 | 31 / 14 | |
| 0.12.1 | 31 / 14 | |
| 0.11.18 | 32 / 15 | |
| 0.11.16 | 34 / 19 | |
| 0.11.15 | 34 / 19 |
v0.12.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.12.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.12.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.11.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.