@holoscript/cli
Command-line interface for HoloScript — compile, validate, dev-serve, and analyze .holo files
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | no-provenance | AI (provenance): Manual publish consistent across this package's history; no attestation regression. | ai | |
| phantom-deps | phantom-dep:@holoscript/platform | AI (phantom-deps): Same-org monorepo dependency, not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@holoscript/hololand-platform | AI (phantom-deps): Same-org optional dep, consistent with monorepo structure. | ai | |
| provenance | missing-githead | AI (provenance): No provenance regression; publisher has consistent manual-publish history. | ai | |
| phantom-deps | phantom-dep:@holoscript/absorb-service | AI (phantom-deps): Same-org optional dep, consistent with monorepo structure. | ai | |
| phantom-deps | phantom-dep:@holoscript/formatter | AI (phantom-deps): Same-org optional dep, consistent with monorepo structure. | ai | |
| dependencies | unvetted-dep:@holoscript/platform | AI (dependencies): Same-org first-party dep pinned to monorepo version 6.1.0. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase consistent with bundling new 3D asset libraries. | ai | |
| phantom-deps | phantom-dep:@gltf-transform/extensions | AI (phantom-deps): Used via config/build tooling, not direct import. | ai | |
| phantom-deps | phantom-dep:@gltf-transform/core | AI (phantom-deps): Used via config/build tooling, not direct import. | ai | |
| phantom-deps | phantom-dep:meshoptimizer | AI (phantom-deps): Used via config/build tooling, not direct import. | ai | |
| phantom-deps | phantom-dep:draco3d | AI (phantom-deps): Used via config/build tooling, not direct import. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are established glTF/3D libraries matching package purpose. | ai | |
| phantom-deps | phantom-dep:@holoscript/framework | AI (phantom-deps): Same org scope; likely loaded by convention in the holoscript monorepo rather than directly imported. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): CLI tool; dotenv loaded via config convention, not direct import. | ai | |
| phantom-deps | phantom-dep:@holoscript/llm-provider | AI (phantom-deps): Same-org scoped package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:tree-sitter-typescript | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:tree-sitter-javascript | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:@holoscript/core-types | AI (phantom-deps): Same-org types package; used at type-level, not direct runtime import. | ai | |
| phantom-deps | phantom-dep:tree-sitter-python | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:tree-sitter-rust | AI (phantom-deps): Grammar loaded dynamically; stable false positive. | ai | |
| phantom-deps | phantom-dep:@holoscript/sdk | AI (phantom-deps): Same-org scoped package; loaded by convention. | ai | |
| phantom-deps | phantom-dep:tree-sitter-go | AI (phantom-deps): Grammar loaded dynamically; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@types/adm-zip | AI (phantom-deps): Type-only package; not directly imported at runtime by design. | ai | |
| phantom-deps | phantom-dep:tree-sitter | AI (phantom-deps): Tree-sitter and grammars loaded dynamically by the compiler; stable false positive. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Dev-serve watcher; loaded by convention in CLI tooling. | ai | |
| phantom-deps | phantom-dep:adm-zip | AI (phantom-deps): Referenced in config files; stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @holoscript/cli is unrelated to joi; Levenshtein match is coincidental. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 8.0.12 | 26 / 5 | |
| 8.0.11 | 24 / 5 | |
| 8.0.10 | 24 / 5 | |
| 8.0.9 | 19 / 5 | |
| 8.0.7 | 19 / 5 | |
| 8.0.6 | 19 / 5 | |
| 7.0.0 | 16 / 5 | |
| 6.1.1 | 19 / 5 | |
| 6.1.0 | 19 / 5 | |
| 6.0.4 | 15 / 5 | |
| 6.0.3 | 15 / 5 | |
| 6.0.0 | 14 / 5 | |
| 5.1.0 | 13 / 5 | |
| 5.0.0 | 11 / 5 | |
| 2.1.0 | 1 / 2 | |
| 2.0.2 | 1 / 2 | |
| 2.0.1 | 1 / 2 | |
| 2.0.0 | 1 / 2 |
v8.0.12
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: brianonbased.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v8.0.6
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: brianonbased.