@kevisual/cli
envision 命令行工具
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:eventemitter3 | AI (phantom-deps): Bundled CLI; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@kevisual/auth | AI (phantom-deps): Same-org scoped dep; bundled output pattern, stable false positive. | ai | |
| phantom-deps | phantom-dep:@opencode-ai/sdk | AI (phantom-deps): Bundled CLI; phantom-dep false positive for this package. | ai | |
| phantom-deps | phantom-dep:@inquirer/prompts | AI (phantom-deps): Bundled CLI; phantom-dep false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @kevisual/cli; levenshtein match to 'joi' is a false positive across all versions. | ai | |
| phantom-deps | phantom-dep:ink | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:pm2 | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:jose | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:dayjs | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:lowdb | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Declared runtime dep (used with ink); bundled via bun. | ai | |
| phantom-deps | phantom-dep:busboy | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:nanoid | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:hash-wasm | AI (phantom-deps): Declared runtime dep; bundled via bun. | ai | |
| phantom-deps | phantom-dep:lru-cache | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:unstorage | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:micromatch | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:gray-matter | AI (phantom-deps): Declared runtime dep; bundled via bun, not directly imported in analyzed files. | ai | |
| phantom-deps | phantom-dep:@kevisual/app | AI (phantom-deps): Same-org dep; bundled via bun. | ai | |
| phantom-deps | phantom-dep:@types/busboy | AI (phantom-deps): Type-only dep; false positive for phantom-dep rule. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 0.1.45 | 27 / 25 | |
| 0.1.44 | 27 / 25 | |
| 0.1.43 | 27 / 25 | |
| 0.1.41 | 27 / 25 | |
| 0.1.40 | 23 / 24 | |
| 0.1.39 | 23 / 24 | |
| 0.1.38 | 23 / 24 | |
| 0.1.37 | 22 / 25 | |
| 0.1.36 | 22 / 25 |
v0.1.45
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.44
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.43
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.41
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.40
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.39
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.38
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.37
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.36
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.