@npmcli/metavuln-calculator ISC 26 versions

@npmcli/metavuln-calculator

npm Repository Homepage

Calculate meta-vulnerabilities from package security advisories

Versions

ISC

License

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

saquibkhannpm-cli-opsreggiowlstronaut

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): Publisher change from isaacs to gar reflects a legitimate npm org maintainer transition; gar is a well-established npm publisher with a long track record.	ai	2026/04/24
maintainer-change	maintainer-added	AI (maintainer-change): fritzy and lukekarrys are known npm org contributors; addition reflects normal org team expansion, not a compromise.	ai	2026/04/24
publish-pattern	new-deps-added	AI (publish-pattern): json-parse-even-better-errors is a well-established npm org package; its addition is benign and expected for JSON parsing in this context.	ai	2026/04/24
dependencies	unvetted-dep:pacote	AI (dependencies): pacote is a core npm CLI dependency maintained by the same GitHub/npm org; its presence in @npmcli packages is expected and benign.	ai	2026/04/21
dependencies	unvetted-dep:json-parse-even-better-errors	AI (dependencies): json-parse-even-better-errors is a well-known npm ecosystem utility maintained by the npm org; its use here is expected and benign.	ai	2026/04/21