@holoscript/cli
Command-line interface for HoloScript — compile, validate, dev-serve, and analyze .holo files
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@holoscript/llm-provider | AI (phantom-deps): Same-org scoped package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): CLI tool; dotenv loaded via config convention, not direct import. | ai | |
| phantom-deps | phantom-dep:adm-zip | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Dev-serve watcher; loaded by convention in CLI tooling. | ai | |
| phantom-deps | phantom-dep:tree-sitter | AI (phantom-deps): Tree-sitter and grammars loaded dynamically by the compiler; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/adm-zip | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| phantom-deps | phantom-dep:tree-sitter-go | AI (phantom-deps): Grammar loaded dynamically; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@holoscript/sdk | AI (phantom-deps): Same-org scoped package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:tree-sitter-rust | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:tree-sitter-python | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:@holoscript/core-types | AI (phantom-deps): Same-org types package; used at type-level, not direct runtime import. | ai | |
| phantom-deps | phantom-dep:tree-sitter-javascript | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:tree-sitter-typescript | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @holoscript/cli is unrelated to joi; Levenshtein match is coincidental. | ai |
Versions (showing 10 of 10)
| Version | Deps | Published |
|---|---|---|
| 7.0.0 | 16 / 5 | |
| 6.0.4 | 15 / 5 | |
| 6.0.3 | 15 / 5 | |
| 6.0.0 | 14 / 5 | |
| 5.1.0 | 13 / 5 | |
| 5.0.0 | 11 / 5 | |
| 2.1.0 | 1 / 2 | |
| 2.0.2 | 1 / 2 | |
| 2.0.1 | 1 / 2 | |
| 2.0.0 | 1 / 2 |
v7.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v6.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v5.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.