@polkadot-api/cli
Add a chain by using the add command
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): SLSA provenance attestation present; gitHead absence is superseded by stronger CI/CD integrity signal. | ai | |
| provenance | publisher-changed | AI (provenance): voliva is the documented author in package.json; same org repo; 477 approved packages, no rejections. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @polkadot-api/ws-middleware is same-org scope, consistent with this package's dependency pattern. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Type-only package; never directly imported, loaded by convention. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @polkadot-api/cli vs 'joi' is a meaningless Levenshtein match; no impersonation intent. | ai | |
| phantom-deps | phantom-dep:@polkadot-api/json-rpc-provider | AI (phantom-deps): Same-org scoped package; used indirectly through other @polkadot-api deps. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): commander is a CLI framework dependency; used transitively or via @commander-js/extra-typings. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): typescript is a build-time dep for a CLI that compiles user code; expected not to be directly imported. | ai |
Versions (showing 8 of 108)
| Version | Deps | Published |
|---|---|---|
| 0.9.4 | 25 / 1 | |
| 0.9.3 | 25 / 1 | |
| 0.9.2 | 25 / 1 | |
| 0.9.1 | 25 / 1 | |
| 0.9.0 | 25 / 1 | |
| 0.8.2 | 25 / 1 | |
| 0.8.1 | 25 / 1 | |
| 0.8.0 | 25 / 1 |
v0.9.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.