@salesforce/plugin-info
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Salesforce consolidates CLI plugin maintenance under salesforce-admin service account; this is a known org-wide pattern, not a takeover signal. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Mass removal of individual maintainers in favor of a service account is consistent with Salesforce's documented CLI maintenance consolidation strategy. | ai | |
| provenance | no-provenance | AI (provenance): Salesforce uses their own signing infrastructure (sfdx.publicKeyUrl/signatureUrl in package.json) as an alternative to Sigstore provenance. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): The doctor command legitimately spreads process.env into spawn() to pass environment to child processes while overriding specific vars. This is standard CLI tooling behavior, not a security risk for this package. | ai |
Versions (showing 100 of 226)
| Version | Deps | Published |
|---|---|---|
| 3.4.155 | 12 / 15 | |
| 3.4.154 | 12 / 15 | |
| 3.4.153 | 12 / 15 | |
| 3.4.152 | 12 / 15 | |
| 3.4.151 | 12 / 15 | |
| 3.4.150 | 12 / 15 | |
| 3.4.149 | 12 / 15 | |
| 3.4.148 | 12 / 15 | |
| 3.4.147 | 12 / 15 | |
| 3.4.144 | 12 / 15 | |
| 3.4.143 | 12 / 15 | |
| 3.4.142 | 12 / 15 | |
| 3.4.141 | 12 / 15 | |
| 3.4.140 | 12 / 15 | |
| 3.4.139 | 12 / 15 | |
| 3.4.138 | 12 / 15 | |
| 3.4.137 | 12 / 15 | |
| 3.4.136 | 12 / 15 | |
| 3.4.135 | 12 / 15 | |
| 3.4.134 | 12 / 15 | |
| 3.4.133 | 12 / 15 | |
| 3.4.132 | 12 / 15 | |
| 3.4.131 | 12 / 15 | |
| 3.4.130 | 12 / 15 | |
| 3.4.129 | 12 / 15 | |
| 3.4.128 | 12 / 15 | |
| 3.4.127 | 12 / 15 | |
| 3.4.126 | 12 / 15 | |
| 3.4.125 | 12 / 15 | |
| 3.4.124 | 12 / 15 | |
| 3.4.123 | 12 / 15 | |
| 3.4.122 | 12 / 15 | |
| 3.4.121 | 12 / 15 | |
| 3.4.120 | 12 / 15 | |
| 3.4.118 | 12 / 15 | |
| 3.4.117 | 12 / 15 | |
| 3.4.116 | 12 / 15 | |
| 3.4.115 | 12 / 15 | |
| 3.4.114 | 12 / 15 | |
| 3.4.113 | 12 / 15 | |
| 3.4.112 | 12 / 15 | |
| 3.4.111 | 12 / 15 | |
| 3.4.110 | 12 / 15 | |
| 3.4.109 | 12 / 15 | |
| 3.4.108 | 12 / 15 | |
| 3.4.107 | 12 / 15 | |
| 3.4.106 | 12 / 15 | |
| 3.4.105 | 12 / 15 | |
| 3.4.104 | 12 / 15 | |
| 3.4.103 | 12 / 15 | |
| 3.4.102 | 12 / 15 | |
| 3.4.101 | 12 / 15 | |
| 3.4.100 | 12 / 15 | |
| 3.4.99 | 12 / 15 | |
| 3.4.98 | 12 / 15 | |
| 3.4.96 | 12 / 15 | |
| 3.4.95 | 12 / 15 | |
| 3.4.94 | 12 / 15 | |
| 3.4.93 | 12 / 15 | |
| 3.4.89 | 12 / 15 | |
| 3.4.88 | 12 / 15 | |
| 3.4.87 | 12 / 15 | |
| 3.4.86 | 12 / 15 | |
| 3.4.85 | 12 / 15 | |
| 3.4.84 | 12 / 15 | |
| 3.4.83 | 12 / 15 | |
| 3.4.82 | 12 / 15 | |
| 3.4.81 | 12 / 15 | |
| 3.4.80 | 12 / 15 | |
| 3.4.79 | 12 / 15 | |
| 3.4.78 | 12 / 15 | |
| 3.4.77 | 12 / 15 | |
| 3.4.76 | 12 / 15 | |
| 3.4.75 | 12 / 15 | |
| 3.4.74 | 12 / 15 | |
| 3.4.73 | 12 / 15 | |
| 3.4.72 | 12 / 15 | |
| 3.4.71 | 12 / 15 | |
| 3.4.70 | 12 / 15 | |
| 3.4.69 | 12 / 15 | |
| 3.4.68 | 12 / 15 | |
| 3.4.67 | 12 / 15 | |
| 3.4.66 | 12 / 15 | |
| 3.4.65 | 12 / 15 | |
| 3.4.64 | 12 / 15 | |
| 3.4.63 | 12 / 15 | |
| 3.4.62 | 12 / 15 | |
| 3.4.61 | 12 / 15 | |
| 3.4.60 | 12 / 15 | |
| 3.4.59 | 12 / 15 | |
| 3.4.58 | 12 / 15 | |
| 3.4.57 | 12 / 15 | |
| 3.4.56 | 12 / 15 | |
| 3.4.55 | 12 / 15 | |
| 3.4.54 | 12 / 15 | |
| 3.4.53 | 12 / 15 | |
| 3.4.52 | 12 / 15 | |
| 3.4.51 | 12 / 15 | |
| 3.4.50 | 12 / 15 | |
| 3.4.49 | 12 / 15 |
v3.4.155
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.154
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.153
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.152
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.151
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.150
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.149
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.148
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.147
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.54
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.53
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.52
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.51
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.50
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.4.49
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.