@salesforce/plugin-info
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Salesforce consolidates CLI plugin maintenance under salesforce-admin service account; this is a known org-wide pattern, not a takeover signal. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Mass removal of individual maintainers in favor of a service account is consistent with Salesforce's documented CLI maintenance consolidation strategy. | ai | |
| provenance | no-provenance | AI (provenance): Salesforce uses their own signing infrastructure (sfdx.publicKeyUrl/signatureUrl in package.json) as an alternative to Sigstore provenance. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): The doctor command legitimately spreads process.env into spawn() to pass environment to child processes while overriding specific vars. This is standard CLI tooling behavior, not a security risk for this package. | ai |
Versions (showing 51 of 226)
| Version | Deps | Published |
|---|---|---|
| 3.4.155 | 12 / 15 | |
| 3.4.154 | 12 / 15 | |
| 3.4.153 | 12 / 15 | |
| 3.4.152 | 12 / 15 | |
| 3.4.151 | 12 / 15 | |
| 3.4.150 | 12 / 15 | |
| 3.4.149 | 12 / 15 | |
| 3.4.148 | 12 / 15 | |
| 3.4.147 | 12 / 15 | |
| 3.4.144 | 12 / 15 | |
| 3.4.143 | 12 / 15 | |
| 3.4.142 | 12 / 15 | |
| 3.4.141 | 12 / 15 | |
| 3.4.140 | 12 / 15 | |
| 3.4.139 | 12 / 15 | |
| 3.4.138 | 12 / 15 | |
| 3.4.137 | 12 / 15 | |
| 3.4.136 | 12 / 15 | |
| 3.4.135 | 12 / 15 | |
| 3.4.134 | 12 / 15 | |
| 3.4.133 | 12 / 15 | |
| 3.4.132 | 12 / 15 | |
| 3.4.131 | 12 / 15 | |
| 3.4.130 | 12 / 15 | |
| 3.4.129 | 12 / 15 | |
| 3.4.128 | 12 / 15 | |
| 3.4.127 | 12 / 15 | |
| 3.4.126 | 12 / 15 | |
| 3.4.125 | 12 / 15 | |
| 3.4.124 | 12 / 15 | |
| 3.4.123 | 12 / 15 | |
| 3.4.122 | 12 / 15 | |
| 3.4.121 | 12 / 15 | |
| 3.4.120 | 12 / 15 | |
| 3.4.118 | 12 / 15 | |
| 3.4.117 | 12 / 15 | |
| 3.4.116 | 12 / 15 | |
| 3.4.115 | 12 / 15 | |
| 3.4.114 | 12 / 15 | |
| 3.4.113 | 12 / 15 | |
| 3.4.112 | 12 / 15 | |
| 3.4.111 | 12 / 15 | |
| 3.4.110 | 12 / 15 | |
| 3.4.109 | 12 / 15 | |
| 3.4.108 | 12 / 15 | |
| 3.4.107 | 12 / 15 | |
| 3.4.106 | 12 / 15 | |
| 3.4.105 | 12 / 15 | |
| 3.4.104 | 12 / 15 | |
| 3.4.103 | 12 / 15 | |
| 3.4.102 | 12 / 15 |
v3.4.155
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.154
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.153
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.152
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.151
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.150
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.149
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.148
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.147
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.