← Home

@dreb/coding-agent

npm Repository Homepage

Coding agent CLI with read, bash, edit, write tools and session management

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

aebrer

Keywords

coding-agentaillmclituiagent

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:steganography-image-eval AI (semgrep): Fires on examples/doom-overlay reading a WAD game file, not a steganography attack. ai
semgrep semgrep:new-function-constructor AI (semgrep): Used in doom-overlay example to load a pre-built Doom JS module; not user-controlled input. ai
semgrep semgrep:base64-decode AI (semgrep): Decodes AI-generated image data in an example extension; legitimate use. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): 127.0.0.1 localhost OAuth redirect URI in a GitLab Duo example; standard OAuth PKCE pattern. ai
semgrep semgrep:child-process-import AI (semgrep): Used in notify.ts example to send Windows toast notifications via PowerShell; benign. ai
phantom-deps phantom-dep:tree-sitter-c AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-go AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-cpp AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-java AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-rust AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-python AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-javascript AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:tree-sitter-typescript AI (phantom-deps): Tree-sitter grammars loaded dynamically at runtime; not directly imported in source. ai
phantom-deps phantom-dep:web-tree-sitter AI (phantom-deps): Loaded dynamically; phantom-dep heuristic false positive for this package. ai
phantom-deps phantom-dep:glob AI (phantom-deps): Used in config/build tooling; phantom-dep heuristic false positive. ai
phantom-deps phantom-dep:@huggingface/transformers AI (phantom-deps): Loaded dynamically for ML inference; phantom-dep heuristic false positive. ai

Versions (showing 51 of 74)

View all versions
Version Deps Published
2.34.3 32 / 8
2.34.2 32 / 8
2.34.1 32 / 8
2.34.0 32 / 8
2.33.0 32 / 8
2.32.1 32 / 8
2.32.0 32 / 8
2.31.1 32 / 8
2.31.0 32 / 8
2.30.1 32 / 8
2.30.0 32 / 8
2.29.0 32 / 8
2.28.0 32 / 8
2.27.3 32 / 8
2.27.2 32 / 8
2.25.4 32 / 8
2.25.3 32 / 8
2.25.2 32 / 8
2.25.1 32 / 8
2.25.0 32 / 8
2.24.0 32 / 8
2.23.0 32 / 8
2.22.1 32 / 8
2.22.0 32 / 8
2.21.1 32 / 8
2.21.0 32 / 8
2.20.0 32 / 8
2.19.3 32 / 8
2.19.2 32 / 8
2.19.1 32 / 8
2.19.0 32 / 8
2.18.0 32 / 8
2.17.0 32 / 8
2.16.0 32 / 8
2.15.2 32 / 8
2.15.1 32 / 8
2.15.0 32 / 8
2.14.1 32 / 8
2.14.0 32 / 8
2.13.0 32 / 8
2.12.1 32 / 8
2.12.0 32 / 8
2.11.1 32 / 8
2.11.0 32 / 8
2.10.0 32 / 8
2.9.0 32 / 8
2.8.0 32 / 8
2.7.0 32 / 8
2.6.3 32 / 8
2.6.2 32 / 8
2.6.1 32 / 8

v2.34.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.34.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.