@kilocode/cli
15
Versions
—
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
marius-kilocodeolelveshelix_kiloscott-kilojohndotawesomestorms42alex-alecu-kilocodeemilie_kilocatrielmullerrso
Keywords
clituiterminalaiagentassistantcoding-agentkilo-codekiloopencodeinkreactcopilotautocompletedeveloper-tools
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Scoped CLI distribution packages commonly omit description/keywords/repo; 167 versions and 23k downloads confirm legitimacy. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing with SLSA attestation; legitimate automated release pipeline for this package. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall selects platform-specific prebuilt binary from optional deps; standard pattern for this package type. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in postinstall for binary selection/execution; expected for a native CLI binary installer. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @kilocode/cli with legitimate GitHub repo; Levenshtein match to 'joi' is a false positive. | ai |