@lenne.tech/cli
lenne.Tech CLI: lt
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:build/commands/claude/install-commands.js | AI (source-diff): Standard tsc-compiled TypeScript output; long lines are generated code, not obfuscation. | ai | |
| source-diff | obfuscated-file:build/commands/claude/install-mcps.js | AI (source-diff): Standard tsc-compiled TypeScript output; long lines are generated code, not obfuscation. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @lenne.tech/cli is not a plausible typosquat of joi; Levenshtein match is spurious. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall runs bin/postinstall.js for CLI config setup; errors suppressed, consistent with documented CLI tool behavior across 167 versions. | ai | |
| phantom-deps | phantom-dep:@lenne.tech/cli-plugin-helper | AI (phantom-deps): Same-org plugin dependency; likely loaded dynamically by the CLI framework (gluegun). Stable false positive. | ai | |
| phantom-deps | phantom-dep:ts-node | AI (phantom-deps): ts-node is a runtime dep used via CLI invocation, not direct import; stable false positive for this package. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in postinstall for CLI setup; stable pattern across this package's history. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 1.22.0 | 18 / 17 | |
| 1.10.0 | 14 / 17 | |
| 1.9.6 | 12 / 17 | |
| 1.0.2 | 13 / 16 | |
| 1.0.1 | 13 / 16 | |
| 1.0.0 | 13 / 16 | |
| 0.0.125 | 12 / 15 |
v1.22.0
2 findingsScript: node bin/postinstall.js 2>/dev/null || true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.10.0
2 findingsScript: node bin/postinstall.js 2>/dev/null || true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.6
2 findingsScript: node bin/postinstall.js 2>/dev/null || true
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.125
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.