@salesforce/plugin-deploy-retrieve
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-bulk-read | AI (semgrep): The env key enumeration is a CI environment detection pattern (checking for CI_ prefixed vars like GitLab CI). No credential harvesting or exfiltration; stable false positive for this package. | ai |
Versions (showing 100 of 110)
| Version | Deps | Published |
|---|---|---|
| 3.24.54 | 13 / 12 | |
| 3.24.53 | 13 / 12 | |
| 3.24.52 | 13 / 12 | |
| 3.24.51 | 13 / 12 | |
| 3.24.50 | 13 / 12 | |
| 3.24.49 | 13 / 12 | |
| 3.24.48 | 13 / 12 | |
| 3.24.47 | 13 / 12 | |
| 3.24.46 | 13 / 12 | |
| 3.24.45 | 13 / 12 | |
| 3.24.44 | 13 / 12 | |
| 3.24.43 | 13 / 12 | |
| 3.24.42 | 13 / 12 | |
| 3.24.41 | 13 / 12 | |
| 3.24.40 | 13 / 12 | |
| 3.24.39 | 13 / 12 | |
| 3.24.38 | 13 / 12 | |
| 3.24.37 | 13 / 12 | |
| 3.24.36 | 13 / 12 | |
| 3.24.35 | 13 / 12 | |
| 3.24.34 | 13 / 12 | |
| 3.24.33 | 13 / 12 | |
| 3.24.32 | 13 / 12 | |
| 3.24.31 | 13 / 12 | |
| 3.24.30 | 13 / 12 | |
| 3.24.29 | 13 / 12 | |
| 3.24.28 | 13 / 12 | |
| 3.24.27 | 13 / 12 | |
| 3.24.26 | 13 / 12 | |
| 3.24.25 | 13 / 12 | |
| 3.24.24 | 13 / 12 | |
| 3.24.23 | 13 / 12 | |
| 3.24.22 | 13 / 12 | |
| 3.24.21 | 13 / 12 | |
| 3.24.20 | 13 / 12 | |
| 3.24.19 | 13 / 12 | |
| 3.24.18 | 13 / 12 | |
| 3.24.17 | 13 / 12 | |
| 3.24.16 | 13 / 12 | |
| 3.24.15 | 13 / 12 | |
| 3.24.14 | 13 / 12 | |
| 3.24.13 | 13 / 12 | |
| 3.24.12 | 13 / 12 | |
| 3.24.11 | 13 / 12 | |
| 3.24.10 | 13 / 12 | |
| 3.24.9 | 13 / 12 | |
| 3.24.8 | 13 / 12 | |
| 3.24.7 | 13 / 12 | |
| 3.24.6 | 13 / 12 | |
| 3.24.5 | 13 / 12 | |
| 3.24.4 | 13 / 12 | |
| 3.24.3 | 13 / 12 | |
| 3.24.2 | 13 / 12 | |
| 3.24.1 | 13 / 12 | |
| 3.24.0 | 13 / 12 | |
| 3.23.16 | 13 / 12 | |
| 3.23.15 | 13 / 12 | |
| 3.23.14 | 13 / 12 | |
| 3.23.13 | 13 / 12 | |
| 3.23.12 | 13 / 12 | |
| 3.23.11 | 13 / 12 | |
| 3.23.10 | 13 / 12 | |
| 3.23.9 | 13 / 12 | |
| 3.23.8 | 13 / 12 | |
| 3.23.7 | 13 / 12 | |
| 3.23.6 | 13 / 12 | |
| 3.23.5 | 13 / 12 | |
| 3.23.3 | 13 / 12 | |
| 3.23.2 | 13 / 12 | |
| 3.23.1 | 13 / 12 | |
| 3.23.0 | 13 / 12 | |
| 3.22.43 | 13 / 12 | |
| 3.22.42 | 13 / 12 | |
| 3.22.41 | 13 / 12 | |
| 3.22.40 | 13 / 12 | |
| 3.22.39 | 13 / 12 | |
| 3.22.38 | 13 / 12 | |
| 3.22.37 | 13 / 12 | |
| 3.22.36 | 13 / 12 | |
| 3.22.35 | 13 / 12 | |
| 3.22.34 | 13 / 12 | |
| 3.22.33 | 13 / 12 | |
| 3.22.32 | 13 / 12 | |
| 3.22.31 | 13 / 12 | |
| 3.22.30 | 13 / 12 | |
| 3.22.29 | 13 / 12 | |
| 3.22.28 | 13 / 12 | |
| 3.22.27 | 13 / 12 | |
| 3.22.26 | 13 / 12 | |
| 3.22.25 | 13 / 12 | |
| 3.22.24 | 13 / 12 | |
| 3.22.23 | 13 / 12 | |
| 3.22.22 | 13 / 12 | |
| 3.22.21 | 13 / 12 | |
| 3.22.20 | 13 / 12 | |
| 3.22.19 | 13 / 12 | |
| 3.22.18 | 13 / 12 | |
| 3.22.17 | 13 / 12 | |
| 3.22.16 | 13 / 12 | |
| 3.22.15 | 13 / 12 |
v3.24.54
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.53
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.52
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.51
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.50
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.49
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.48
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.47
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.46
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.45
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.44
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.43
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.42
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.41
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.40
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.39
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.38
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.37
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.24.36
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.35
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.24.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.24.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.24.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.24.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.24.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.23.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.43
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.42
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.41
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.40
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.39
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.38
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.37
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.36
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.35
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.34
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.33
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.32
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.31
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.30
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.29
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.16
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.22.15
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.