← Home

@pagopa/dx-cli

npm Repository

A CLI useful to manage DX tools.

81
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

pp-psgiuseppe-nuccio-creadiego.lagosmorales

Keywords

DXCLI

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff source-size-tripled AI (source-diff): Growth explained by vendored official Azure SDK deps, not injected code. ai
provenance publisher-changed AI (provenance): Switch to GitHub Actions CI publisher with SLSA attestation, not an account takeover. ai
publish-pattern new-deps-added AI (publish-pattern): All new deps are official @azure/@microsoft SDKs matching CLI's Azure management purpose. ai
phantom-deps phantom-dep:@opentelemetry/sdk-logs AI (phantom-deps): Used via OTel config wiring, not direct import; expected for instrumentation setup. ai
source-diff obfuscated-file:dist/adapters/azure-monitor/instrumentation.js AI (source-diff): Readable commented OTel bootstrap code, not obfuscated; long line is compiled output. ai
source-diff obfuscated-file:dist/adapters/plop/actions/sync-repository-environments.js AI (source-diff): Readable TF-config helper code, not obfuscated. ai
source-diff obfuscated-file:dist/adapters/commander/command-errors.js AI (source-diff): Sample shows clean compiled ESM output; long lines are TypeScript build artifacts, not obfuscation. ai
dependencies unvetted-dep:@azure/keyvault-secrets AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@azure/arm-msi AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@pagopa/dx-savemoney AI (dependencies): Sibling @pagopa scoped package from the same org/repo; expected dependency for this CLI. ai
dependencies unvetted-dep:@azure/arm-storage AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@azure/arm-keyvault AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@azure/arm-resources AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@azure/arm-authorization AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@azure/arm-resourcegraph AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai
dependencies unvetted-dep:@azure/arm-resources-subscriptions AI (dependencies): Official Azure SDK package from Microsoft; stable false positive for this CLI tool. ai

Versions (showing 81 of 81)

Version Deps Published
0.26.1 36 / 15
0.26.0 36 / 15
0.25.3 36 / 15
0.25.2 36 / 15
0.25.1 36 / 15
0.25.0 36 / 15
0.24.0 28 / 15
0.23.5 28 / 15
0.23.4 28 / 15
0.23.3 28 / 15
0.23.2 28 / 15
0.23.1 28 / 15
0.23.0 28 / 15
0.22.4 28 / 15
0.22.3 28 / 15
0.22.2 28 / 15
0.22.1 28 / 14
0.22.0 28 / 14
0.21.6 28 / 14
0.21.5 28 / 14
0.21.4 28 / 14
0.21.3 28 / 14
0.21.2 28 / 14
0.21.1 28 / 14
0.21.0 28 / 14
0.20.2 28 / 14
0.20.1 27 / 13
0.20.0 27 / 13
0.19.3 27 / 13
0.19.2 27 / 13
0.19.1 27 / 13
0.19.0 27 / 13
0.18.13 27 / 13
0.18.12 27 / 13
0.18.11 27 / 13
0.18.10 27 / 13
0.18.9 27 / 13
0.18.8 27 / 13
0.18.7 27 / 13
0.18.6 27 / 13
0.18.5 27 / 13
0.18.4 27 / 13
0.18.3 27 / 13
0.18.2 27 / 13
0.18.1 27 / 13
0.18.0 27 / 13
0.16.3 25 / 13
0.16.2 25 / 13
0.16.1 25 / 13
0.16.0 25 / 13
0.15.5 25 / 13
0.15.4 25 / 13
0.15.3 24 / 14
0.15.2 16 / 12
0.15.1 16 / 12
0.15.0 16 / 12
0.14.5 16 / 12
0.14.4 16 / 12
0.14.3 16 / 12
0.14.2 16 / 12
0.14.1 16 / 12
0.14.0 16 / 12
0.13.0 16 / 12
0.11.2 14 / 12
0.11.1 14 / 12
0.11.0 14 / 12
0.10.3 14 / 12
0.10.2 14 / 12
0.10.1 14 / 12
0.10.0 14 / 12
0.9.0 14 / 12
0.8.2 13 / 12
0.8.1 13 / 12
0.8.0 13 / 12
0.7.0 13 / 12
0.6.0 10 / 12
0.5.0 8 / 12
0.4.4 8 / 12
0.4.3 8 / 12
0.4.2 6 / 11
0.4.1 6 / 11

v0.26.1

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.26.0

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.25.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.25.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.25.1

3 findings
HIGH New obfuscated file: dist/adapters/azure-monitor/instrumentation.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/adapters/plop/actions/sync-repository-environments.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.25.0

3 findings
HIGH New obfuscated file: dist/adapters/azure-monitor/instrumentation.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/adapters/plop/actions/sync-repository-environments.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.21.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.11

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-26) provenance

This version was published by a different npm account than previous versions on 2026-03-26. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.10

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-23) provenance

This version was published by a different npm account than previous versions on 2026-03-23. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.9

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-23) provenance

This version was published by a different npm account than previous versions on 2026-03-23. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.8

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-20) provenance

This version was published by a different npm account than previous versions on 2026-03-20. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.7

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-18) provenance

This version was published by a different npm account than previous versions on 2026-03-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.6

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-17) provenance

This version was published by a different npm account than previous versions on 2026-03-17. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.5

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-16) provenance

This version was published by a different npm account than previous versions on 2026-03-16. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.4

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-12) provenance

This version was published by a different npm account than previous versions on 2026-03-12. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.3

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-10) provenance

This version was published by a different npm account than previous versions on 2026-03-10. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.2

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-09) provenance

This version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.1

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-09) provenance

This version was published by a different npm account than previous versions on 2026-03-09. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.18.0

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-03-04) provenance

This version was published by a different npm account than previous versions on 2026-03-04. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.3

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-02-19) provenance

This version was published by a different npm account than previous versions on 2026-02-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.2

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-02-19) provenance

This version was published by a different npm account than previous versions on 2026-02-19. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.1

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-02-18) provenance

This version was published by a different npm account than previous versions on 2026-02-18. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.16.0

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-02-10) provenance

This version was published by a different npm account than previous versions on 2026-02-10. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.5

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-30) provenance

This version was published by a different npm account than previous versions on 2026-01-30. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.4

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-28) provenance

This version was published by a different npm account than previous versions on 2026-01-28. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.3

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-28) provenance

This version was published by a different npm account than previous versions on 2026-01-28. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.2

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-27) provenance

This version was published by a different npm account than previous versions on 2026-01-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.1

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-27) provenance

This version was published by a different npm account than previous versions on 2026-01-27. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.15.0

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-26) provenance

This version was published by a different npm account than previous versions on 2026-01-26. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.5

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-23) provenance

This version was published by a different npm account than previous versions on 2026-01-23. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.14.4

2 findings
HIGH Publisher changed: pagopa-bot → GitHub Actions (on 2026-01-16) provenance

This version was published by a different npm account than previous versions on 2026-01-16. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.