@instructure/command-utils
Node CLI utilities made by Instructure Inc.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Still SLSA-attested via CI/CD, provenance direction unchanged vs prior approved version. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Large org maintainer list churn, consistent with CI-driven publishing, not a takeover. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Large monorepo team roster churn, no behavioral change accompanying it. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Command utility intentionally passes process.env to child processes; standard subprocess launcher pattern. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Resolves a package's own bin field from package.json; not loading arbitrary user-controlled modules. | ai |
Versions (showing 16 of 16)
| Version | Deps | Published |
|---|---|---|
| 11.7.4 | 3 / 0 | |
| 11.7.3 | 3 / 0 | |
| 11.7.2 | 3 / 0 | |
| 11.7.1 | 3 / 0 | |
| 11.7.0 | 3 / 0 | |
| 11.6.0 | 3 / 0 | |
| 11.5.0 | 3 / 0 | |
| 11.4.0 | 3 / 0 | |
| 11.3.0 | 3 / 0 | |
| 11.2.0 | 3 / 0 | |
| 11.0.1 | 3 / 0 | |
| 11.0.0 | 3 / 0 | |
| 10.30.0 | 3 / 0 | |
| 10.29.0 | 3 / 0 | |
| 10.26.4 | 3 / 0 | |
| 10.26.3 | 3 / 0 |
v11.7.4
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.7.1
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.7.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.6.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.5.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v11.4.0
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.30.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.29.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.