@nocobase/cli
<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>
59
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
chenosjiannlu
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | net-exec-file:src/util.js | AI (source-diff): Standard CLI utility code: execa for subprocesses, net for port detection, dotenv for config — no dropper behavior. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Major CLI rewrite from commander to oclif; new files reflect legitimate architectural expansion. | ai | |
| phantom-deps | phantom-dep:@inquirer/type | AI (phantom-deps): Type-only package used for TypeScript type declarations; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:openapi-types | AI (phantom-deps): Type-only dependency used in config/type declarations; not directly imported at runtime. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by oclif migration, bundled DB drivers, and interactive prompt libraries. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo sub-package CLI tool; documentation lives in the main project repo. README signals are expected for this package structure. | ai | |
| dependencies | unvetted-dep:pm2 | AI (dependencies): pm2 is a well-known, widely-used Node.js process manager. Legitimate dependency for a CLI tool. | ai | |
| dependencies | unvetted-dep:@umijs/utils | AI (dependencies): @umijs/utils is part of the established UmiJS ecosystem, used here for dev tooling. | ai | |
| dependencies | unvetted-dep:@nocobase/license-kit | AI (dependencies): First-party NocoBase license management package, consistent with the project's own ecosystem. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to parse npm CLI stdout (JS array literal) for version listing — input is controlled, not user-supplied. Stable pattern for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads cronstrue locale files; input is constrained by a known langs map, not arbitrary user input. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP 127.0.0.1 is localhost used as a local dev proxy fallback. Completely benign for a development CLI tool. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx is a TypeScript runner invoked by the CLI as a subprocess, not imported directly. Expected pattern. | ai | |
| phantom-deps | phantom-dep:pm2 | AI (phantom-deps): pm2 is used as a process manager at runtime by the CLI; phantom-dep detection is a false positive for this usage pattern. | ai | |
| phantom-deps | phantom-dep:@types/fs-extra | AI (phantom-deps): @types packages are type definitions used at compile time, not imported at runtime. Standard pattern. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @nocobase/cli is a scoped package for the NocoBase platform, not a typosquat of joi. Levenshtein comparison is a false positive on scoped package names. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into subprocess env is standard CLI dev tool behavior for forwarding shell environment to child processes. Not credential exfiltration. | ai |
Versions (showing 59 of 159)
| Version | Deps | Published |
|---|---|---|
| 1.9.58 | 17 / 1 | |
| 1.9.57 | 17 / 1 | |
| 1.9.56 | 17 / 1 | |
| 1.9.55 | 17 / 1 | |
| 1.9.54 | 17 / 1 | |
| 1.9.53 | 17 / 1 | |
| 1.9.52 | 17 / 1 | |
| 1.9.51 | 17 / 1 | |
| 1.9.49 | 17 / 1 | |
| 1.9.47 | 17 / 1 | |
| 1.9.46 | 17 / 1 | |
| 1.9.45 | 17 / 1 | |
| 1.9.44 | 17 / 1 | |
| 1.9.43 | 17 / 1 | |
| 1.9.42 | 17 / 1 | |
| 1.9.41 | 17 / 1 | |
| 1.9.40 | 17 / 1 | |
| 1.9.39 | 17 / 1 | |
| 1.9.38 | 17 / 1 | |
| 1.9.37 | 17 / 1 | |
| 1.9.36 | 17 / 1 | |
| 1.9.35 | 17 / 1 | |
| 1.9.34 | 17 / 1 | |
| 1.9.33 | 17 / 1 | |
| 1.9.32 | 17 / 1 | |
| 1.9.31 | 17 / 1 | |
| 1.9.30 | 17 / 1 | |
| 1.9.29 | 17 / 1 | |
| 1.9.28 | 17 / 1 | |
| 1.9.27 | 17 / 1 | |
| 1.9.26 | 17 / 1 | |
| 1.9.25 | 17 / 1 | |
| 1.9.24 | 17 / 1 | |
| 1.9.23 | 17 / 1 | |
| 1.9.22 | 17 / 1 | |
| 1.9.21 | 17 / 1 | |
| 1.9.20 | 17 / 1 | |
| 1.9.19 | 17 / 1 | |
| 1.9.18 | 17 / 1 | |
| 1.9.17 | 17 / 1 | |
| 1.9.16 | 17 / 1 | |
| 1.9.15 | 17 / 1 | |
| 1.9.14 | 17 / 1 | |
| 1.9.13 | 17 / 1 | |
| 1.9.12 | 17 / 1 | |
| 1.9.11 | 17 / 1 | |
| 1.9.10 | 17 / 1 | |
| 1.9.9 | 17 / 1 | |
| 1.9.8 | 17 / 1 | |
| 1.9.7 | 17 / 1 | |
| 1.9.6 | 17 / 1 | |
| 1.9.5 | 17 / 1 | |
| 1.9.4 | 17 / 1 | |
| 1.9.3 | 17 / 1 | |
| 1.9.2 | 17 / 1 | |
| 1.9.1 | 17 / 1 | |
| 1.9.0 | 17 / 1 | |
| 1.8.33 | 17 / 1 | |
| 1.8.32 | 17 / 1 |