@eui/cli
eUI CLI app generator & tools
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@eui/tools | AI (dependencies): First-party sibling package under same @eui org, not an unvetted third party. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Consolidation of scaffolding deps into first-party @eui/tools, not an axios-style attack vector. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI tool legitimately uses child_process to run lint and build commands. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @eui/cli is the EU Commission's official CLI tool; no resemblance to joi in purpose or namespace. | ai | |
| phantom-deps | phantom-dep:cross-spawn | AI (phantom-deps): cross-spawn is declared in dependencies and used via config/scripts; stable false positive for this package. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): 127.0.0.1 reference is in a commented-out CORS example in a skeleton template file. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): CLI tool loads sub-scripts by path at runtime; standard plugin/command dispatch pattern. | ai |
Versions (showing 21 of 21)
| Version | Deps | Published |
|---|---|---|
| 21.4.0 | 7 / 0 | |
| 21.3.3 | 7 / 0 | |
| 21.3.2 | 7 / 0 | |
| 21.3.1 | 7 / 0 | |
| 21.3.0 | 7 / 0 | |
| 21.2.6 | 7 / 0 | |
| 21.2.5 | 7 / 0 | |
| 21.2.4 | 7 / 0 | |
| 21.2.3 | 10 / 0 | |
| 21.2.2 | 10 / 0 | |
| 21.2.1 | 10 / 0 | |
| 21.2.0 | 10 / 0 | |
| 21.1.1 | 10 / 0 | |
| 21.1.0 | 10 / 0 | |
| 21.0.4 | 9 / 0 | |
| 21.0.3 | 9 / 0 | |
| 21.0.2 | 6 / 0 | |
| 21.0.1 | 6 / 0 | |
| 19.3.13 | 1 / 0 | |
| 19.3.12 | 1 / 0 | |
| 19.3.8 | 1 / 0 |
v21.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.3.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v21.2.0
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (rambou) than the most recent previously approved version (ec.europa.eui) on 2026-03-13, but rambou is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v19.3.13
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (rambou) than the most recent previously approved version (ec.europa.eui) on 2026-03-12, but rambou is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v19.3.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.