← Home

@etohq/cli

npm Repository Homepage

Command Line interface for Eto Commerce

4
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

solarsoft0

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:hosted-git-info AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:pg AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config, not direct top-level imports. ai
phantom-deps phantom-dep:chalk AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:execa AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:yargs AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:pg-god AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:express AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:prompts AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:fs-extra AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:inquirer AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
phantom-deps phantom-dep:@etohq/eto AI (phantom-deps): Same-org scoped dep; expected indirect usage pattern for this monorepo CLI. ai
phantom-deps phantom-dep:@etohq/utils AI (phantom-deps): Same-org scoped dep; expected indirect usage pattern for this monorepo CLI. ai
phantom-deps phantom-dep:is-valid-path AI (phantom-deps): CLI tool with dist/ bundle; deps referenced indirectly or via config. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped @etohq/cli has no plausible relation to 'joi'; false positive on edit distance. ai

Versions (showing 4 of 4)

Version Deps Published
2.0.1 23 / 12
2.0.0 23 / 12
1.5.3 23 / 12
1.5.2 23 / 12

v2.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.5.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.