@salesforce/plugin-info
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Salesforce consolidates CLI plugin maintenance under salesforce-admin service account; this is a known org-wide pattern, not a takeover signal. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Mass removal of individual maintainers in favor of a service account is consistent with Salesforce's documented CLI maintenance consolidation strategy. | ai | |
| provenance | no-provenance | AI (provenance): Salesforce uses their own signing infrastructure (sfdx.publicKeyUrl/signatureUrl in package.json) as an alternative to Sigstore provenance. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): The doctor command legitimately spreads process.env into spawn() to pass environment to child processes while overriding specific vars. This is standard CLI tooling behavior, not a security risk for this package. | ai |
Versions (showing 51 of 80)
| Version | Deps | Published |
|---|---|---|
| 3.4.139 | 12 / 15 | |
| 3.4.138 | 12 / 15 | |
| 3.4.137 | 12 / 15 | |
| 3.4.136 | 12 / 15 | |
| 3.4.135 | 12 / 15 | |
| 3.4.134 | 12 / 15 | |
| 3.4.133 | 12 / 15 | |
| 3.4.132 | 12 / 15 | |
| 3.4.131 | 12 / 15 | |
| 3.4.130 | 12 / 15 | |
| 3.4.129 | 12 / 15 | |
| 3.4.128 | 12 / 15 | |
| 3.4.127 | 12 / 15 | |
| 3.4.126 | 12 / 15 | |
| 3.4.125 | 12 / 15 | |
| 3.4.124 | 12 / 15 | |
| 3.4.123 | 12 / 15 | |
| 3.4.122 | 12 / 15 | |
| 3.4.121 | 12 / 15 | |
| 3.4.120 | 12 / 15 | |
| 3.4.118 | 12 / 15 | |
| 3.4.117 | 12 / 15 | |
| 3.4.116 | 12 / 15 | |
| 3.4.115 | 12 / 15 | |
| 3.4.114 | 12 / 15 | |
| 3.4.113 | 12 / 15 | |
| 3.4.112 | 12 / 15 | |
| 3.4.111 | 12 / 15 | |
| 3.4.110 | 12 / 15 | |
| 3.4.109 | 12 / 15 | |
| 3.4.108 | 12 / 15 | |
| 3.4.107 | 12 / 15 | |
| 3.4.106 | 12 / 15 | |
| 3.4.105 | 12 / 15 | |
| 3.4.104 | 12 / 15 | |
| 3.4.103 | 12 / 15 | |
| 3.4.102 | 12 / 15 | |
| 3.4.101 | 12 / 15 | |
| 3.4.100 | 12 / 15 | |
| 3.4.99 | 12 / 15 | |
| 3.4.98 | 12 / 15 | |
| 3.4.96 | 12 / 15 | |
| 3.4.95 | 12 / 15 | |
| 3.4.94 | 12 / 15 | |
| 3.4.93 | 12 / 15 | |
| 3.4.89 | 12 / 15 | |
| 3.4.88 | 12 / 15 | |
| 3.4.87 | 12 / 15 | |
| 3.4.86 | 12 / 15 | |
| 3.4.85 | 12 / 15 | |
| 3.4.84 | 12 / 15 |
v3.4.139
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.138
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.137
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.136
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.135
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.134
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.133
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.132
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.131
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.130
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.129
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.128
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.127
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.126
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.125
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.124
2 findingsSpreading entire process.env into an object — may capture all secrets 205 | const cp = spawn(cmdString, [], { 206 | shell: true, > 207 | env: Object.assign({}, { 208 | ...process.env, 209 | SF_LOG_COLORIZE: 'false',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.123
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.122
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.121
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.120
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.118
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.117
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.116
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.115
2 findingsSpreading entire process.env into an object — may capture all secrets 205 | const cp = spawn(cmdString, [], { 206 | shell: true, > 207 | env: Object.assign({}, { 208 | ...process.env, 209 | SF_LOG_COLORIZE: 'false',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.112
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.95
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.94
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.93
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.89
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.88
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.87
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.86
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.85
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.84
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.