@proto-kit/cli
A comprehensive command-line interface for managing Proto-Kit applications, environments, and blockchain interactions.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env copy is used solely to inject TS_NODE_* vars before child process spawn; not an exfiltration risk. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @proto-kit/cli is unrelated to joi; Levenshtein match is a false positive. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 0.2.0 | 10 / 3 |
v0.2.0
2 findingsSpreading entire process.env into an object — may capture all secrets 31 | 32 | if (!process.env.TS_NODE_LOADER_ACTIVE) { > 33 | const env = { ...process.env }; 34 | env.TS_NODE_LOADER_ACTIVE = "1"; 35 | env.TS_NODE_TRANSPILE_ONLY = "true";
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.