@faststore/cli — Greenflagged

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

emersonlaurentinoguieevcmarcos_vtexlariciamotaeduardo.formigahellofanny

Keywords

oclif

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:@vtex/faststore-sdk	AI (dependencies): Same org scope (@vtex) as this package; canary version is expected for internal SDK dependency.	ai	2026/06/02
provenance	missing-githead	AI (provenance): Package uses SLSA provenance attestation via GitHub Actions; gitHead absence is a minor metadata gap, not a supply chain risk.	ai	2026/06/02
phantom-deps	phantom-dep:oclif	AI (phantom-deps): oclif is declared in oclif config section of package.json; not directly imported but legitimately used as CLI tooling.	ai	2026/05/26
phantom-deps	phantom-dep:@inquirer/confirm	AI (phantom-deps): CLI prompt library; may be used indirectly via oclif or dynamic require patterns in CLI tooling.	ai	2026/05/26
provenance	publisher-changed	AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation; stable pattern for vtex/faststore org going forward.	ai	2026/05/21
typosquat	typosquat.levenshtein:joi	AI (typosquat): Scoped @faststore/cli is a legitimate VTEX FastStore package; Levenshtein match to 'joi' is a false positive.	ai	2026/05/17
phantom-deps	phantom-dep:@faststore/core	AI (phantom-deps): Same-org dep used indirectly by the CLI framework; stable false positive.	ai	2026/05/17
phantom-deps	phantom-dep:@antfu/ni	AI (phantom-deps): Used via CLI invocation in scripts/config, not direct import; stable pattern for this package.	ai	2026/05/17
phantom-deps	phantom-dep:@oclif/plugin-not-found	AI (phantom-deps): Declared as oclif plugin in config; not directly imported by design.	ai	2026/05/17
phantom-deps	phantom-dep:@oclif/plugin-help	AI (phantom-deps): Declared as oclif plugin in config; not directly imported by design.	ai	2026/05/17

Versions (showing 100 of 144)

Version	Deps	Published
4.1.2	22 / 11	2026-06-01
4.1.1	22 / 11	2026-05-15
4.1.0	22 / 10	2026-05-11
3.100.0	13 / 12	2026-06-02
3.99.6	13 / 12	2026-05-19
3.99.4	13 / 12	2026-05-14
3.99.3	13 / 12	2026-05-12
3.99.2	13 / 12	2026-05-11
3.99.1	13 / 12	2026-05-06
3.99.0	13 / 12	2026-05-04
3.98.4	13 / 12	2026-04-15
3.98.3	13 / 12	2026-04-09
3.98.2	13 / 12	2026-04-09
3.98.1	13 / 12	2026-04-07
3.98.0	13 / 12	2026-03-27
3.97.1	13 / 12	2026-02-24
3.97.0	13 / 12	2026-02-03
3.96.5	13 / 12	2026-02-02
3.96.4	13 / 12	2026-01-26
3.96.3	13 / 12	2026-01-21
3.96.2	13 / 12	2026-01-14
3.96.1	13 / 12	2026-01-09
3.96.0	13 / 12	2025-12-24
3.95.0	13 / 12	2025-12-02
3.94.0	13 / 12	2025-11-19
3.93.0	13 / 12	2025-11-04
3.92.0	13 / 12	2025-11-03
3.91.2	13 / 12	2025-10-27
3.91.1	13 / 12	2025-10-24
3.91.0	13 / 12	2025-10-24
3.90.1	13 / 12	2025-10-20
3.90.0	13 / 12	2025-10-13
3.89.6	13 / 12	2025-10-09
3.89.5	13 / 12	2025-10-08
3.89.4	13 / 12	2025-10-06
3.89.3	13 / 12	2025-10-03
3.89.2	13 / 12	2025-10-02
3.89.1	13 / 12	2025-10-02
3.89.0	13 / 12	2025-10-02
3.88.7	13 / 12	2025-09-25
3.88.6	13 / 12	2025-09-23
3.88.5	13 / 12	2025-09-22
3.88.4	13 / 12	2025-09-22
3.88.3	13 / 12	2025-09-22
3.88.2	13 / 12	2025-09-19
3.88.1	13 / 12	2025-09-19
3.88.0	13 / 12	2025-09-18
3.87.0	13 / 12	2025-09-18
3.86.4	13 / 12	2025-09-17
3.86.3	13 / 12	2025-09-17
3.86.2	13 / 12	2025-09-16
3.86.1	13 / 12	2025-09-16
3.86.0	13 / 12	2025-09-15
3.85.0	13 / 12	2025-09-15
3.84.5	13 / 12	2025-09-15
3.84.4	13 / 12	2025-09-15
3.84.3	13 / 12	2025-09-12
3.84.2	13 / 12	2025-09-12
3.84.1	13 / 12	2025-09-11
3.84.0	13 / 12	2025-09-09
3.83.1	13 / 12	2025-09-09
3.83.0	13 / 12	2025-09-09
3.82.4	13 / 12	2025-09-08
3.82.3	13 / 12	2025-09-08
3.82.2	13 / 12	2025-09-05
3.82.1	13 / 12	2025-09-05
3.82.0	13 / 12	2025-09-05
3.81.0	13 / 12	2025-09-05
3.80.0	13 / 12	2025-09-04
3.79.1	13 / 12	2025-09-04
3.79.0	13 / 12	2025-09-03
3.78.0	13 / 12	2025-09-02
3.77.3	13 / 12	2025-09-01
3.77.2	13 / 12	2025-08-21
3.77.1	13 / 12	2025-08-20
3.77.0	13 / 12	2025-08-18
3.76.0	13 / 12	2025-08-14
3.75.1	13 / 12	2025-08-08
3.75.0	13 / 12	2025-08-07
3.74.0	13 / 12	2025-08-07
3.73.0	13 / 12	2025-08-07
3.72.1	13 / 12	2025-08-07
3.72.0	13 / 12	2025-08-05
3.71.0	13 / 12	2025-08-05
3.70.2	13 / 12	2025-08-05
3.70.1	13 / 12	2025-08-04
3.70.0	13 / 12	2025-08-01
3.69.1	13 / 12	2025-08-01
3.69.0	13 / 12	2025-07-31
3.68.2	13 / 12	2025-07-29
3.68.1	13 / 12	2025-07-29
3.68.0	13 / 12	2025-07-28
3.67.0	13 / 12	2025-07-23
3.66.0	13 / 12	2025-07-23
3.65.2	13 / 12	2025-07-22
3.65.1	13 / 12	2025-07-17
3.65.0	13 / 12	2025-07-16
3.64.1	13 / 12	2025-07-16
3.64.0	13 / 12	2025-07-15
3.63.1	13 / 12	2025-07-15

Showing 100 of 144 Next page →

v4.1.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v4.1.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.100.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.99.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.99.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.99.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.99.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.99.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.99.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.98.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.98.3

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-04-09) provenance

This version was published by a different npm account than previous versions on 2026-04-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.98.2

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-04-09) provenance

This version was published by a different npm account than previous versions on 2026-04-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.98.1

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-04-07) provenance

This version was published by a different npm account than previous versions on 2026-04-07. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.98.0

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-03-27) provenance

This version was published by a different npm account than previous versions on 2026-03-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.97.1

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-02-24) provenance

This version was published by a different npm account than previous versions on 2026-02-24. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.97.0

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-02-03) provenance

This version was published by a different npm account than previous versions on 2026-02-03. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.96.5

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-02-02) provenance

This version was published by a different npm account than previous versions on 2026-02-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.96.4

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-01-26) provenance

This version was published by a different npm account than previous versions on 2026-01-26. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.96.3

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-01-21) provenance

This version was published by a different npm account than previous versions on 2026-01-21. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.96.2

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-01-14) provenance

This version was published by a different npm account than previous versions on 2026-01-14. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.96.1

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2026-01-09) provenance

This version was published by a different npm account than previous versions on 2026-01-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.96.0

2 findings

HIGH Publisher changed: emersonlaurentino → GitHub Actions (on 2025-12-24) provenance

This version was published by a different npm account than previous versions on 2025-12-24. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.