@pulumi/command

[](https://github.com/pulumi/pulumi-command/actions) [](https://slack.pulumi.com) [![NPM version](https://bad

Supply chain provenance

Status for the latest visible version.

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

Keywords

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): Standard Pulumi plugin binary fetch pattern; stable and documented across all @pulumi/* provider packages.	ai	2026/04/29
typosquat	typosquat.levenshtein:commander	AI (typosquat): @pulumi/command is a scoped official Pulumi provider, not a typosquat of commander.	ai	2026/04/29
semgrep	semgrep:child-process-import	AI (semgrep): child_process used in install script to invoke pulumi plugin download; expected and benign for this package.	ai	2026/04/29

Version	Deps	Published
1.2.1	1 / 2	2026-03-04
1.2.0	1 / 2	2026-02-20
1.1.2	1 / 2	2025-09-29
1.1.0	1 / 2	2025-05-27
1.0.3	1 / 2	2025-05-01