← Home

@microsoft/m365agentstoolkit-cli

npm Repository Homepage

Microsoft 365 Agents Toolkit CLI

3
Versions
MIT
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

microsoft1esmicrosoft-oss-releaseszhyuernintanmsteamsfx

Keywords

teamsfxteamsfx-cliteamsapp-clim365agentstoolkit-cliteamsappm365agentsatk

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
install-scripts install-script:postinstall AI (install-scripts): deletePS1.js removes a stale local .ps1 from npm prefix; no network/exec of fetched code. ai
source-diff obfuscated-file:lib/280.js AI (source-diff): Webpack minified bundle output, not obfuscation. ai
source-diff obfuscated-file:lib/36.js AI (source-diff): Webpack bundle (node open module); build output. ai
source-diff encoded-string-file:lib/index.js AI (source-diff): Webpack bundle banner; long strings are minified module output. ai
semgrep semgrep:child-process-import AI (semgrep): child_process in deletePS1 used for npm config get prefix; benign. ai

Versions (showing 3 of 3)

Version Deps Published
1.1.12 27 / 48
1.1.11 27 / 50
1.1.10 27 / 50

v1.1.12

5 findings
HIGH Package has 'postinstall' script install-scripts

Script: node deletePS1.js

HIGH New obfuscated file: lib/280.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — minified bundler output, not obfuscation on its own.

HIGH New obfuscated file: lib/36.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

HIGH Long encoded string in modified file: lib/index.js source-diff

Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads. Artifact: bundled (webpack) — bundler banner in the scanned head, but the file is larger than the scan window and its remainder is unclassified, so this is not a clean bill of health.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.