@nocobase/cli
<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:src/util.js | AI (source-diff): Standard CLI utility code: execa for subprocesses, net for port detection, dotenv for config — no dropper behavior. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major CLI rewrite from commander to oclif; new files reflect legitimate architectural expansion. | ai | |
| phantom-deps | phantom-dep:@inquirer/type | AI (phantom-deps): Type-only package used for TypeScript type declarations; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:openapi-types | AI (phantom-deps): Type-only dependency used in config/type declarations; not directly imported at runtime. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by oclif migration, bundled DB drivers, and interactive prompt libraries. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo sub-package CLI tool; documentation lives in the main project repo. README signals are expected for this package structure. | ai | |
| dependencies | unvetted-dep:pm2 | AI (dependencies): pm2 is a well-known, widely-used Node.js process manager. Legitimate dependency for a CLI tool. | ai | |
| dependencies | unvetted-dep:@umijs/utils | AI (dependencies): @umijs/utils is part of the established UmiJS ecosystem, used here for dev tooling. | ai | |
| dependencies | unvetted-dep:@nocobase/license-kit | AI (dependencies): First-party NocoBase license management package, consistent with the project's own ecosystem. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to parse npm CLI stdout (JS array literal) for version listing — input is controlled, not user-supplied. Stable pattern for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads cronstrue locale files; input is constrained by a known langs map, not arbitrary user input. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP 127.0.0.1 is localhost used as a local dev proxy fallback. Completely benign for a development CLI tool. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx is a TypeScript runner invoked by the CLI as a subprocess, not imported directly. Expected pattern. | ai | |
| phantom-deps | phantom-dep:pm2 | AI (phantom-deps): pm2 is used as a process manager at runtime by the CLI; phantom-dep detection is a false positive for this usage pattern. | ai | |
| phantom-deps | phantom-dep:@types/fs-extra | AI (phantom-deps): @types packages are type definitions used at compile time, not imported at runtime. Standard pattern. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @nocobase/cli is a scoped package for the NocoBase platform, not a typosquat of joi. Levenshtein comparison is a false positive on scoped package names. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into subprocess env is standard CLI dev tool behavior for forwarding shell environment to child processes. Not credential exfiltration. | ai |
Versions (showing 51 of 158)
| Version | Deps | Published |
|---|---|---|
| 2.1.30 | 14 / 4 | |
| 2.1.29 | 14 / 4 | |
| 2.1.28 | 14 / 4 | |
| 2.1.27 | 14 / 4 | |
| 2.1.26 | 14 / 4 | |
| 2.1.25 | 14 / 4 | |
| 2.1.24 | 14 / 4 | |
| 2.1.23 | 14 / 4 | |
| 2.1.22 | 14 / 4 | |
| 2.1.21 | 14 / 4 | |
| 2.1.20 | 14 / 4 | |
| 2.1.19 | 14 / 4 | |
| 2.1.18 | 14 / 4 | |
| 2.1.17 | 14 / 4 | |
| 2.1.15 | 14 / 4 | |
| 2.1.14 | 14 / 4 | |
| 2.1.12 | 14 / 4 | |
| 2.1.11 | 14 / 4 | |
| 2.1.10 | 14 / 4 | |
| 2.1.9 | 14 / 4 | |
| 2.1.8 | 14 / 4 | |
| 2.1.7 | 14 / 4 | |
| 2.1.6 | 14 / 4 | |
| 2.1.5 | 14 / 4 | |
| 2.1.4 | 14 / 4 | |
| 2.1.3 | 14 / 4 | |
| 2.1.2 | 14 / 4 | |
| 2.1.1 | 14 / 4 | |
| 2.1.0 | 14 / 4 | |
| 2.0.62 | 17 / 1 | |
| 2.0.61 | 17 / 1 | |
| 2.0.60 | 17 / 1 | |
| 2.0.59 | 17 / 1 | |
| 2.0.58 | 17 / 1 | |
| 2.0.57 | 17 / 1 | |
| 2.0.56 | 17 / 1 | |
| 2.0.55 | 17 / 1 | |
| 2.0.54 | 17 / 1 | |
| 2.0.53 | 17 / 1 | |
| 2.0.52 | 17 / 1 | |
| 2.0.51 | 17 / 1 | |
| 2.0.50 | 17 / 1 | |
| 2.0.49 | 17 / 1 | |
| 2.0.48 | 17 / 1 | |
| 2.0.47 | 17 / 1 | |
| 2.0.46 | 17 / 1 | |
| 2.0.45 | 17 / 1 | |
| 2.0.44 | 17 / 1 | |
| 2.0.43 | 17 / 1 | |
| 2.0.42 | 17 / 1 | |
| 2.0.41 | 17 / 1 |
v2.1.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.14
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.