@gapi/cli
Gapi command line interface
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:uninstall | AI (phantom-deps): Legacy dep in long-running CLI, no evidence of malicious use. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Same runner pattern, dual-use and expected in a CLI generator. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Used in CLI runner to shell out to build tools, expected for this package. | ai | |
| phantom-deps | phantom-dep:@angular-devkit/schematics | AI (phantom-deps): Official Angular tooling dep, expected for scaffolding CLI. | ai | |
| phantom-deps | phantom-dep:parcel-plugin-shebang | AI (phantom-deps): Parcel bundler plugin, consistent with build scripts. | ai | |
| phantom-deps | phantom-dep:@angular-devkit/core | AI (phantom-deps): Official Angular tooling dep, well-known and expected. | ai | |
| phantom-deps | phantom-dep:@rxdi/schematics | AI (phantom-deps): Angular schematics ecosystem dep, expected for scaffolding CLI. | ai | |
| phantom-deps | phantom-dep:shell-quote | AI (phantom-deps): Shell utility consistent with CLI's exec functionality. | ai | |
| phantom-deps | phantom-dep:node.extend | AI (phantom-deps): Utility dep, low risk for established CLI package. | ai | |
| phantom-deps | phantom-dep:mkdirp | AI (phantom-deps): Common utility used by CLI tooling, likely bundled/dynamic usage. | ai | |
| phantom-deps | phantom-dep:@angular-devkit/schematics-cli | AI (phantom-deps): Official Angular tooling dep, expected for scaffolding CLI. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Likely used in bundled dist not scanned by heuristic. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Fires in webpack bundle output, standard bundler pattern not eval-injection. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Standard CLI prompt lib, likely used in bundled/minified code. | ai | |
| dependencies | unvetted-dep:pkg | AI (dependencies): pkg is a well-known Vercel/zeit packaging tool, standard for CLI binaries. | ai | |
| phantom-deps | phantom-dep:systemjs | AI (phantom-deps): Referenced in config files as expected for this CLI; stable false positive. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): CLI tool uses chokidar for file watching via config; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:node-notifier | AI (phantom-deps): Referenced in config files for notifications; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:@zeit/ncc | AI (phantom-deps): Build/bundle tool referenced in config; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:pkg | AI (phantom-deps): CLI tool that bundles/packages apps; pkg referenced in config files is expected usage pattern. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @gapi/cli is a scoped GraphQL CLI tool with 743 versions; edit-distance match to 'joi' is a false positive. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads a user-supplied external options file (program.externalOptions); intentional CLI extension point, not arbitrary code injection. | ai | |
| phantom-deps | phantom-dep:@gapi/schematics | AI (phantom-deps): Same org scope; schematics used as a CLI sub-tool, not directly imported in source. | ai | |
| phantom-deps | phantom-dep:graphql-document-collector | AI (phantom-deps): GraphQL tooling referenced in config files; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:apollo-codegen | AI (phantom-deps): GraphQL codegen tool invoked via CLI config; not directly imported but legitimately used. | ai |
Versions (showing 51 of 264)
| Version | Deps | Published |
|---|---|---|
| 1.8.217 | 22 / 12 | |
| 1.8.216 | 22 / 12 | |
| 1.8.215 | 22 / 12 | |
| 1.8.34 | 19 / 11 | |
| 1.8.33 | 17 / 11 | |
| 1.8.32 | 17 / 11 | |
| 1.8.31 | 24 / 11 | |
| 1.8.30 | 24 / 11 | |
| 1.8.29 | 24 / 11 | |
| 1.8.23 | 28 / 12 | |
| 1.8.22 | 28 / 12 | |
| 1.8.21 | 28 / 12 | |
| 1.8.20 | 28 / 12 | |
| 1.8.19 | 27 / 12 | |
| 1.8.18 | 27 / 12 | |
| 1.8.17 | 27 / 12 | |
| 1.8.16 | 27 / 12 | |
| 1.8.15 | 27 / 12 | |
| 1.8.14 | 27 / 12 | |
| 1.8.13 | 27 / 12 | |
| 1.8.12 | 27 / 12 | |
| 1.8.11 | 27 / 12 | |
| 1.8.10 | 27 / 12 | |
| 1.8.9 | 27 / 12 | |
| 1.8.8 | 27 / 12 | |
| 1.8.7 | 27 / 12 | |
| 1.8.6 | 27 / 12 | |
| 1.8.5 | 27 / 12 | |
| 1.8.4 | 27 / 12 | |
| 1.8.3 | 27 / 12 | |
| 1.8.2 | 27 / 12 | |
| 1.8.1 | 27 / 12 | |
| 1.8.0 | 27 / 12 | |
| 1.7.8 | 27 / 12 | |
| 1.7.7 | 27 / 12 | |
| 1.7.6 | 27 / 12 | |
| 1.7.5 | 27 / 12 | |
| 1.7.4 | 27 / 12 | |
| 1.7.3 | 27 / 12 | |
| 1.7.2 | 27 / 12 | |
| 1.7.1 | 27 / 12 | |
| 1.7.0 | 27 / 12 | |
| 1.6.33 | 27 / 12 | |
| 1.6.32 | 27 / 12 | |
| 1.6.31 | 27 / 12 | |
| 1.6.30 | 27 / 12 | |
| 1.6.29 | 27 / 12 | |
| 1.6.28 | 27 / 12 | |
| 1.6.27 | 27 / 12 | |
| 1.6.26 | 27 / 12 | |
| 1.6.25 | 27 / 12 |
v1.8.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.7.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.31
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.30
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.6.25
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.