@quenty/nevermore-cli
CLI interface for Nevermore
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): New dep is from the same @quenty namespace; consistent with organic CLI feature growth. | ai | |
| install-scripts | install-script:preinstall | AI (install-scripts): npx only-allow pnpm is a standard package manager enforcement guard; benign and stable for this package. | ai | |
| phantom-deps | phantom-dep:node-fetch | AI (phantom-deps): pnpm monorepo; transitive/config-level reference, not a real missing import. | ai | |
| phantom-deps | phantom-dep:find-git-root | AI (phantom-deps): Declared dep used via config, not direct import; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:typescript-memoize | AI (phantom-deps): TypeScript monorepo pattern; config-level reference, not a real phantom dep. | ai |
Versions (showing 51 of 67)
| Version | Deps | Published |
|---|---|---|
| 4.41.0 | 10 / 6 | |
| 4.40.0 | 10 / 6 | |
| 4.39.0 | 10 / 6 | |
| 4.38.0 | 10 / 6 | |
| 4.37.0 | 10 / 6 | |
| 4.36.0 | 10 / 6 | |
| 4.34.0 | 10 / 6 | |
| 4.33.1 | 10 / 6 | |
| 4.33.0 | 10 / 6 | |
| 4.32.0 | 10 / 6 | |
| 4.31.0 | 10 / 6 | |
| 4.30.0 | 10 / 6 | |
| 4.29.2 | 10 / 6 | |
| 4.29.1 | 10 / 6 | |
| 4.29.0 | 10 / 6 | |
| 4.28.1 | 10 / 6 | |
| 4.28.0 | 10 / 6 | |
| 4.27.0 | 10 / 6 | |
| 4.26.0 | 10 / 6 | |
| 4.25.0 | 10 / 6 | |
| 4.24.1 | 10 / 6 | |
| 4.24.0 | 10 / 6 | |
| 4.23.0 | 10 / 6 | |
| 4.22.0 | 10 / 6 | |
| 4.21.0 | 10 / 6 | |
| 4.20.0 | 10 / 6 | |
| 4.19.0 | 10 / 6 | |
| 4.18.0 | 10 / 6 | |
| 4.17.0 | 10 / 5 | |
| 4.16.2 | 10 / 5 | |
| 4.16.1 | 10 / 5 | |
| 4.16.0 | 10 / 5 | |
| 4.15.2 | 9 / 5 | |
| 4.15.1 | 9 / 5 | |
| 4.15.0 | 9 / 5 | |
| 4.14.0 | 9 / 5 | |
| 4.13.2 | 9 / 5 | |
| 4.13.1 | 9 / 5 | |
| 4.13.0 | 9 / 5 | |
| 4.12.4 | 8 / 5 | |
| 4.12.3 | 8 / 5 | |
| 4.12.2 | 8 / 5 | |
| 4.12.1 | 9 / 5 | |
| 4.12.0 | 9 / 5 | |
| 4.11.0 | 9 / 5 | |
| 4.10.0 | 9 / 5 | |
| 4.9.5 | 9 / 5 | |
| 4.9.4 | 9 / 5 | |
| 4.9.3 | 9 / 5 | |
| 4.9.2 | 9 / 5 | |
| 4.9.1 | 9 / 5 |
v4.41.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.40.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.39.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.38.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.37.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.36.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.34.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.33.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.