@emuanalytics/flow-cli
The Flo.w CLI (`flow-engine-cli`) is a command line interface for working with Flo.w Engine via its REST API. It provides developers with tools to work with datasets, pipelines and other Flo.w resources.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/index.mjs | AI (source-diff): Standard unbuild-generated ESM bundle; minified but not obfuscated, no encoded payloads. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:find-up | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:@types/yargs | AI (phantom-deps): Type-only package; framework-scoped, stable false positive. | ai | |
| phantom-deps | phantom-dep:string-width | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:csv-stringify | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:colorette | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:JSONStream | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:loose-json | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:node-emoji | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:cli-spinner | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): Bundled CLI; deps resolved via bundler, not direct imports. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:open | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:execa | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:table | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:yauzl | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:lint-staged | AI (phantom-deps): lint-staged is a dev/config tool referenced in package.json scripts; not a runtime phantom dep. | ai | |
| phantom-deps | phantom-dep:https-proxy-agent | AI (phantom-deps): Listed as a runtime dep and used via config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/uuid | AI (phantom-deps): @types packages are type-only and not directly imported at runtime; stable false positive. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a well-known TypeScript runtime implicit dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:debug | AI (phantom-deps): debug is referenced in config/transitive context; not a real phantom dep concern. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 2.2.8 | 26 / 14 | |
| 2.2.6 | 26 / 14 | |
| 2.2.5 | 26 / 14 | |
| 2.2.4 | 26 / 14 | |
| 2.2.3 | 26 / 14 | |
| 2.2.2 | 25 / 14 | |
| 2.2.1 | 25 / 14 | |
| 2.2.0 | 25 / 14 | |
| 2.1.7 | 30 / 18 |
v2.2.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.2
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.1
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.2.0
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.