← Home

@nocobase/cli

npm Repository Homepage

<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>

51
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

chenosjiannlu

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
bogus-package bogus-package AI (bogus-package): Monorepo sub-package CLI tool; documentation lives in the main project repo. README signals are expected for this package structure. ai
dependencies unvetted-dep:pm2 AI (dependencies): pm2 is a well-known, widely-used Node.js process manager. Legitimate dependency for a CLI tool. ai
dependencies unvetted-dep:@umijs/utils AI (dependencies): @umijs/utils is part of the established UmiJS ecosystem, used here for dev tooling. ai
dependencies unvetted-dep:@nocobase/license-kit AI (dependencies): First-party NocoBase license management package, consistent with the project's own ecosystem. ai
semgrep semgrep:new-function-constructor AI (semgrep): Used to parse npm CLI stdout (JS array literal) for version listing — input is controlled, not user-supplied. Stable pattern for this package. ai
phantom-deps phantom-dep:tsx AI (phantom-deps): tsx is a TypeScript runner invoked by the CLI as a subprocess, not imported directly. Expected pattern. ai
semgrep semgrep:env-spread AI (semgrep): Spreading process.env into subprocess env is standard CLI dev tool behavior for forwarding shell environment to child processes. Not credential exfiltration. ai
phantom-deps phantom-dep:@types/fs-extra AI (phantom-deps): @types packages are type definitions used at compile time, not imported at runtime. Standard pattern. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): Raw IP 127.0.0.1 is localhost used as a local dev proxy fallback. Completely benign for a development CLI tool. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require loads cronstrue locale files; input is constrained by a known langs map, not arbitrary user input. ai
typosquat typosquat.levenshtein:joi AI (typosquat): @nocobase/cli is a scoped package for the NocoBase platform, not a typosquat of joi. Levenshtein comparison is a false positive on scoped package names. ai
phantom-deps phantom-dep:pm2 AI (phantom-deps): pm2 is used as a process manager at runtime by the CLI; phantom-dep detection is a false positive for this usage pattern. ai

Versions (showing 51 of 125)

View all versions
Version Deps Published
2.0.61 17 / 1
2.0.60 17 / 1
2.0.59 17 / 1
2.0.58 17 / 1
2.0.57 17 / 1
2.0.56 17 / 1
2.0.55 17 / 1
2.0.54 17 / 1
2.0.53 17 / 1
2.0.52 17 / 1
2.0.51 17 / 1
2.0.50 17 / 1
2.0.49 17 / 1
2.0.48 17 / 1
2.0.47 17 / 1
2.0.46 17 / 1
2.0.45 17 / 1
2.0.44 17 / 1
2.0.43 17 / 1
2.0.42 17 / 1
2.0.41 17 / 1
2.0.40 17 / 1
2.0.39 17 / 1
2.0.38 17 / 1
2.0.37 17 / 1
2.0.36 17 / 1
2.0.35 17 / 1
2.0.34 17 / 1
2.0.33 17 / 1
2.0.32 17 / 1
2.0.31 17 / 1
2.0.30 17 / 1
2.0.29 17 / 1
2.0.28 17 / 1
2.0.27 17 / 1
2.0.26 17 / 1
2.0.25 17 / 1
2.0.24 17 / 1
2.0.23 17 / 1
2.0.22 17 / 1
2.0.21 17 / 1
2.0.20 17 / 1
2.0.19 17 / 1
2.0.18 17 / 1
2.0.17 17 / 1
2.0.16 17 / 1
2.0.15 17 / 1
2.0.14 17 / 1
2.0.13 17 / 1
2.0.12 17 / 1
2.0.11 17 / 1

v2.0.61

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.60

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.59

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.58

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.57

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.56

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.55

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.54

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.53

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.52

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.51

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.50

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.49

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.48

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.47

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.45

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.44

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.43

4 findings
HIGH env-spread: src/commands/dev.js:54 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/nocobase/nocobase/blob/bc149659b06c5e9a4f55e707f735125801b508be/src/commands/dev.js#L54 52 | console.log('starting client', 1 * clientPort); 53 | subprocess = run('umi', ['dev'], { > 54 | env: { 55 | ...process.env, 56 | stdio: 'inherit',

HIGH env-spread: src/commands/p-test.js:25 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/nocobase/nocobase/blob/bc149659b06c5e9a4f55e707f735125801b508be/src/commands/p-test.js#L25 23 | 24 | const data = fs.readFileSync(ENV_FILE, 'utf-8'); > 25 | const config = { 26 | ...dotenv.parse(data), 27 | ...process.env,

HIGH env-spread: src/util.js:79 semgrep

Spreading entire process.env into an object — may capture all secrets Source: https://github.com/nocobase/nocobase/blob/bc149659b06c5e9a4f55e707f735125801b508be/src/util.js#L79 77 | stdio: 'inherit', 78 | ...options, > 79 | env: { 80 | ...process.env, 81 | ...options.env,

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.42

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.41

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.40

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.39

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.38

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.37

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.36

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.35

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.34

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.33

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.32

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.31

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.30

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.29

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.28

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.27

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.26

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.0.25

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.24

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.23

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.22

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.21

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.20

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.19

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.18

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.17

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.16

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.15

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.14

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.13

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.12

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v2.0.11

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.