@idlebox/cli
11
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
gongt
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): GitHub Actions CI publisher with SLSA provenance attestation; consistent with legitimate CI/CD transition for this author's monorepo. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @idlebox/cli is not a plausible typosquat of joi; Levenshtein match is spurious. | ai |