← Home

@napi-rs/cli

npm Repository Homepage

Cli tools for napi-rs

51
Versions
MIT
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

broooooklynforehalo

Keywords

clirustnapin-apinode-apinode-addonneon

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): SLSA provenance attestation confirms publish originated from the official napi-rs/napi-rs CI/CD pipeline, directly countering account-takeover hypothesis for this package. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @napi-rs/cli is a well-established Rust/Node.js toolchain CLI with no relation to 'joi'; the levenshtein match is a string coincidence, not impersonation. ai
source-diff obfuscated-file:dist/index.cjs AI (source-diff): Standard rolldown-bundled CJS output with visible rolldown runtime preamble. Not obfuscated — minified CLI bundle. ai
source-diff obfuscated-file:dist/cli.js AI (source-diff): Standard rolldown-bundled ESM CLI entry. Rolldown runtime preamble visible; imports are all known packages. ai
source-diff obfuscated-file:dist/index.js AI (source-diff): Standard rolldown-bundled ESM library output. Not obfuscated. ai
source-diff net-exec-file:dist/index.cjs AI (source-diff): Network (Octokit/GitHub API) + child_process (cargo/cross spawning) are core expected features of a Rust native addon build CLI. ai
source-diff obfuscated-file:dist/index.d.cts AI (source-diff): dist/index.d.cts is a bundled TypeScript declaration file generated by tsdown. Long lines are from concatenated type definitions, not obfuscation. Stable false positive for this build toolchain. ai
provenance slsa-provenance AI (provenance): Package consistently publishes via CI/CD with SLSA provenance; this is a stable positive signal for this package. ai
maintainer-change maintainer-takeover AI (maintainer-change): longyinan is the same person as broooooklyn (LongYinan, GitHub: Brooooooklyn) — the original author consolidating under a different npm account. SLSA provenance confirms CI/CD publish. ai
maintainer-change maintainer-added AI (maintainer-change): longyinan is the original author (LongYinan/Brooooooklyn); addition is a legitimate account consolidation, not a hostile actor. ai
maintainer-change maintainer-removed AI (maintainer-change): forehalo and broooooklyn removal is part of the same account consolidation by the original author LongYinan. ai
semgrep semgrep:env-spread AI (semgrep): Build tool that spawns cargo/cross subprocesses legitimately forwards process.env to child processes. This is standard practice for build tooling, not secret exfiltration. ai

Versions (showing 51 of 76)

View all versions
Version Deps Published
3.6.2 12 / 15
3.6.1 12 / 15
3.6.0 12 / 15
3.5.1 12 / 14
3.5.0 12 / 14
3.4.1 12 / 15
3.4.0 12 / 15
3.3.1 12 / 15
3.3.0 12 / 15
3.2.0 13 / 15
3.1.5 13 / 15
3.1.4 13 / 15
3.1.3 13 / 15
3.1.2 13 / 16
3.1.1 13 / 16
3.0.4 13 / 16
3.0.3 14 / 16
3.0.2 14 / 16
3.0.1 14 / 16
3.0.0 14 / 16
2.18.4 0 / 16
2.18.3 0 / 16
2.18.2 0 / 16
2.18.1 0 / 16
2.18.0 0 / 16
2.17.0 0 / 16
2.16.5 0 / 16
2.16.4 0 / 16
2.16.3 0 / 16
2.16.2 0 / 16
2.16.1 0 / 16
2.16.0 0 / 16
2.15.2 0 / 16
2.15.1 0 / 16
2.15.0 0 / 16
2.14.8 0 / 16
2.14.7 0 / 16
2.14.6 0 / 16
2.14.5 0 / 16
2.14.4 0 / 16
2.14.3 0 / 16
2.14.2 0 / 16
2.14.1 0 / 16
2.14.0 0 / 16
2.13.3 0 / 16
2.13.2 0 / 16
2.13.1 0 / 16
2.13.0 0 / 16
2.12.1 0 / 16
2.12.0 0 / 16
2.11.4 0 / 16

v3.6.2

2 findings
HIGH env-spread: src/api/build.ts:305 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/napi-rs/napi-rs/blob/d5c3c43b45393f99ba151770f97bd472de533671/src/api/build.ts#L305 303 | process.env.CARGO ?? (this.options.useCross ? 'cross' : 'cargo') 304 | const buildProcess = spawn(command, this.args, { > 305 | env: { ...process.env, ...this.envs }, 306 | stdio: watch ? ['inherit', 'inherit', 'pipe'] : 'inherit', 307 | cwd: this.options.cwd,

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.6.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.6.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.5.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.5.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.4.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.4.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.3.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.3.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.2.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.4

2 findings
HIGH New obfuscated file: dist/index.d.cts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.3

2 findings
HIGH New obfuscated file: dist/index.d.cts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.1.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.1

6 findings
HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (longyinan) were replaced by new maintainers (broooooklyn, forehalo). This is a strong signal of a potential package hijack and requires careful review.

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/index.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/cli.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v3.0.0

6 findings
HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (longyinan) were replaced by new maintainers (broooooklyn, forehalo). This is a strong signal of a potential package hijack and requires careful review.

HIGH New obfuscated file: dist/index.cjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New file with network + code execution: dist/index.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: dist/cli.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/index.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.18.4

2 findings
HIGH Complete maintainer takeover detected maintainer-change

All previous maintainers (forehalo, broooooklyn) were replaced by new maintainers (longyinan). This is a strong signal of a potential package hijack and requires careful review.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.18.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.18.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.18.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.18.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.17.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.16.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.16.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.16.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v0.2). This is the strongest supply chain integrity signal.

v2.16.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.16.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.15.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.8

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.7

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.6

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.5

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.14.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.13.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.12.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.11.4

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.