← Home

@faststore/cli

npm Repository Homepage
51
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

emersonlaurentinoguieevcmarcos_vtexlariciamotaeduardo.formigahellofanny

Keywords

oclif

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern new-deps-added AI (publish-pattern): All 10 new deps are established ecosystem tools (oclif, graphql-codegen, prettier, etc.) consistent with CLI framework migration. ai
dependencies unvetted-dep:@vtex/faststore-sdk AI (dependencies): Same org scope (@vtex) as this package; canary version is expected for internal SDK dependency. ai
provenance missing-githead AI (provenance): Package uses SLSA provenance attestation via GitHub Actions; gitHead absence is a minor metadata gap, not a supply chain risk. ai
phantom-deps phantom-dep:oclif AI (phantom-deps): oclif is declared in oclif config section of package.json; not directly imported but legitimately used as CLI tooling. ai
phantom-deps phantom-dep:@inquirer/confirm AI (phantom-deps): CLI prompt library; may be used indirectly via oclif or dynamic require patterns in CLI tooling. ai
provenance publisher-changed AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation; stable pattern for vtex/faststore org going forward. ai
typosquat typosquat.levenshtein:joi AI (typosquat): Scoped @faststore/cli is a legitimate VTEX FastStore package; Levenshtein match to 'joi' is a false positive. ai
phantom-deps phantom-dep:@faststore/core AI (phantom-deps): Same-org dep used indirectly by the CLI framework; stable false positive. ai
phantom-deps phantom-dep:@antfu/ni AI (phantom-deps): Used via CLI invocation in scripts/config, not direct import; stable pattern for this package. ai
phantom-deps phantom-dep:@oclif/plugin-not-found AI (phantom-deps): Declared as oclif plugin in config; not directly imported by design. ai
phantom-deps phantom-dep:@oclif/plugin-help AI (phantom-deps): Declared as oclif plugin in config; not directly imported by design. ai

Versions (showing 51 of 335)

View all versions
Version Deps Published
4.4.0 22 / 11
4.3.0 22 / 11
4.2.0 22 / 11
4.1.2 22 / 11
4.1.1 22 / 11
4.1.0 22 / 10
3.100.3 13 / 12
3.100.2 13 / 12
3.100.1 13 / 12
3.100.0 13 / 12
3.99.6 13 / 12
3.99.4 13 / 12
3.99.3 13 / 12
3.99.2 13 / 12
3.99.1 13 / 12
3.99.0 13 / 12
3.98.4 13 / 12
3.98.3 13 / 12
3.98.2 13 / 12
3.98.1 13 / 12
3.98.0 13 / 12
3.97.1 13 / 12
3.97.0 13 / 12
3.96.5 13 / 12
3.96.4 13 / 12
3.96.3 13 / 12
3.96.2 13 / 12
3.96.1 13 / 12
3.96.0 13 / 12
3.95.0 13 / 12
3.94.0 13 / 12
3.93.0 13 / 12
3.92.0 13 / 12
3.91.2 13 / 12
3.91.1 13 / 12
3.91.0 13 / 12
3.90.1 13 / 12
3.90.0 13 / 12
3.89.6 13 / 12
3.89.5 13 / 12
3.89.4 13 / 12
3.89.3 13 / 12
3.89.2 13 / 12
3.89.1 13 / 12
3.89.0 13 / 12
3.88.7 13 / 12
3.88.6 13 / 12
3.88.5 13 / 12
3.88.4 13 / 12
3.88.3 13 / 12
3.88.2 13 / 12

v4.4.0

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

v3.100.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.