@rootplatform/cli
Root Platform CLI
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Used in config/build tooling, not directly imported; stable pattern for this CLI package. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/parser | AI (phantom-deps): ESLint config reference only; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:@typescript-eslint/eslint-plugin | AI (phantom-deps): ESLint config reference only; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Stable false positive for this CLI package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads mocha from a user-configured modulesPath; expected CLI test-runner behavior. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Config-file loaded dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:mocha | AI (phantom-deps): Mocha is loaded dynamically via modulesPath in the test runner script, not via static import. | ai | |
| phantom-deps | phantom-dep:npm | AI (phantom-deps): npm is a CLI tool dependency used by convention, not via direct import. | ai | |
| phantom-deps | phantom-dep:sinon | AI (phantom-deps): Test utility referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:eslint | AI (phantom-deps): Linting tool referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/adm-zip | AI (phantom-deps): Type package; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:prettier | AI (phantom-deps): Formatter referenced in config; stable false positive. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Config-referenced; stable false positive. | ai | |
| phantom-deps | phantom-dep:camelcase-keys | AI (phantom-deps): Config-referenced; stable false positive. | ai | |
| phantom-deps | phantom-dep:snakecase-keys | AI (phantom-deps): Config-referenced; stable false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Package is @rootplatform/cli — a scoped CLI tool, not a typosquat of joi. Levenshtein match is spurious. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP (127.0.0.1) appears only in test files testing localhost URL handling — not a runtime network call. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used in schema-generator to compile Joi schema descriptions; input is internally generated, not user-supplied arbitrary code. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Dev/config-referenced; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:dayjs | AI (phantom-deps): Dev/config-referenced; stable false positive for this CLI package. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 2.0.0 | 29 / 20 | |
| 1.4.26 | 30 / 34 | |
| 1.4.25 | 30 / 34 | |
| 1.4.24 | 30 / 34 | |
| 1.4.23 | 33 / 31 | |
| 1.4.20 | 30 / 34 | |
| 1.4.18 | 30 / 34 |
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.26
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.4.24
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.23
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (nicroot) than the most recent previously approved version (louwhopley) on 2026-02-03, but nicroot is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.4.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.4.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.