@geekmidas/cli
CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs
7
Versions
—
License
No
Install Scripts
Attested
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation (unverified)
npm registry signatures
No source commit
Maintainers
geekmidas
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@geekmidas/manifest | AI (dependencies): First-party @geekmidas org package, same monorepo family as other deps. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is first-party sibling package, not a supply-chain risk. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads package.json by filesystem path; not arbitrary user-controlled module loading. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Fires in encryption test suite validating base64 output; no payload hiding. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Fires in encryption utility decoding AES key/IV from hex; standard crypto pattern. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Pattern is child-process spawn with NODE_OPTIONS injection; not credential exfiltration. | ai | |
| phantom-deps | phantom-dep:openapi-typescript | AI (phantom-deps): Listed as runtime dep; used via config/CLI invocation rather than direct import. | ai | |
| phantom-deps | phantom-dep:@apidevtools/swagger-parser | AI (phantom-deps): Listed as runtime dep; used via config/CLI invocation rather than direct import. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @geekmidas/cli is a scoped CLI tool; levenshtein match to 'joi' is coincidental. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Fires only in test fixtures using 127.0.0.1 localhost addresses. | ai |