@formatjs/cli-lib No license 34 versions

@formatjs/cli-lib

npm Repository Homepage

34

Versions

—

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

longlhoredonkuluspyrocat

Keywords

cliformatformatjsformattingglobalizationi18ninternationalizationintllocalelocalizationreactreact-intlreactjstranslatetranslation

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): formatjs monorepo migrated to GitHub Actions CI publishing; SLSA attestation confirms legitimate automated release pipeline.	ai	2026/05/04
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a standard TypeScript runtime helper; implicit dependency pattern is stable for this package.	ai	2026/05/04
phantom-deps	phantom-dep:@types/node	AI (phantom-deps): Type-only package; framework-scoped, loaded by convention in TypeScript projects.	ai	2026/04/29
phantom-deps	phantom-dep:@types/estree	AI (phantom-deps): Type-only package; framework-scoped, loaded by convention.	ai	2026/04/29
phantom-deps	phantom-dep:commander	AI (phantom-deps): CLI library; commander is a declared runtime dep used by the CLI entry point, not a phantom.	ai	2026/04/29
phantom-deps	phantom-dep:@types/fs-extra	AI (phantom-deps): Type-only package; framework-scoped, loaded by convention.	ai	2026/04/29
phantom-deps	phantom-dep:@formatjs/icu-skeleton-parser	AI (phantom-deps): Same-org formatjs dep; declared runtime dependency, stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:loud-rejection	AI (phantom-deps): Declared runtime dep for unhandled promise rejection handling; stable false positive.	ai	2026/04/29
phantom-deps	phantom-dep:fast-glob	AI (phantom-deps): Declared runtime dep for file globbing in CLI; stable false positive for this package.	ai	2026/04/29

Versions (showing 34 of 34)

Version	Deps	Published
8.7.8	11 / 0	2026-06-06
8.7.7	11 / 0	2026-06-05
8.7.6	11 / 0	2026-06-04
8.7.5	12 / 0	2026-05-28
8.7.4	12 / 0	2026-05-27
8.7.2	12 / 0	2026-05-22
8.7.1	12 / 0	2026-05-19
8.7.0	12 / 0	2026-05-15
8.6.0	12 / 0	2026-05-12
8.5.5	12 / 0	2026-05-05
8.5.4	12 / 0	2026-04-29
8.5.3	12 / 0	2026-04-24
8.5.2	12 / 0	2026-04-13
8.5.1	12 / 0	2026-03-27
8.5.0	12 / 0	2026-03-20
8.4.1	12 / 0	2026-03-19
8.4.0	12 / 0	2026-03-17
8.3.2	12 / 0	2026-03-16
8.3.1	13 / 0	2026-03-09
8.3.0	13 / 0	2026-02-19
8.2.3	14 / 0	2026-02-03
8.2.2	14 / 0	2026-02-01
8.2.1	14 / 0	2026-01-19
8.2.0	14 / 0	2026-01-15
8.1.1	14 / 0	2026-01-06
8.1.0	14 / 0	2026-01-02
8.0.8	14 / 0	2025-12-28
8.0.7	14 / 0	2025-12-26
8.0.6	14 / 0	2025-12-23
8.0.5	14 / 0	2025-12-23
8.0.4	14 / 0	2025-12-19
8.0.2	14 / 0	2025-12-17
8.0.1	14 / 0	2025-12-15
8.0.0	14 / 0	2025-12-15

v8.7.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.7.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.6.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.5.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.5.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.5.1

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-03-27) provenance

This version was published by a different npm account than previous versions on 2026-03-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.5.0

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-03-20) provenance

This version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.4.1

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-03-19) provenance

This version was published by a different npm account than previous versions on 2026-03-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.4.0

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-03-17) provenance

This version was published by a different npm account than previous versions on 2026-03-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.3.2

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-03-16) provenance

This version was published by a different npm account than previous versions on 2026-03-16. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.3.1

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-03-09) provenance

This version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.3.0

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-02-19) provenance

This version was published by a different npm account than previous versions on 2026-02-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.2.3

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-02-03) provenance

This version was published by a different npm account than previous versions on 2026-02-03. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.2.2

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-02-01) provenance

This version was published by a different npm account than previous versions on 2026-02-01. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.2.1

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-01-19) provenance

This version was published by a different npm account than previous versions on 2026-01-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.2.0

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-01-15) provenance

This version was published by a different npm account than previous versions on 2026-01-15. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.1.1

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-01-06) provenance

This version was published by a different npm account than previous versions on 2026-01-06. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.1.0

2 findings

HIGH Publisher changed: longlho → GitHub Actions (on 2026-01-02) provenance

This version was published by a different npm account than previous versions on 2026-01-02. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v8.0.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v8.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v8.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.