@saltcorn/cli — Greenflagged

Command-line interface for Saltcorn, open-source no-code platform

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

tanielsenchristianhugoch

Keywords

oclif

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:env-spread	AI (semgrep): Intentional pattern: spreads process.env to inject PGPASSWORD for pg backup utilities — expected CLI behavior.	ai	2026/05/25
semgrep	semgrep:child-process-import	AI (semgrep): CLI tool legitimately uses child_process for backup/restore commands; stable pattern across all versions.	ai	2026/05/25
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require resolves a package.json path for plugin localization — not arbitrary user input.	ai	2026/05/25
typosquat	typosquat.levenshtein:joi	AI (typosquat): @saltcorn/cli is a scoped package in the saltcorn org; not a typosquat of joi.	ai	2026/05/25
phantom-deps	phantom-dep:node-watch	AI (phantom-deps): Referenced in oclif config/runtime; false positive for this CLI package.	ai	2026/05/25
phantom-deps	phantom-dep:source-map-support	AI (phantom-deps): Loaded via oclif bootstrap, not direct import; stable false positive.	ai	2026/05/25
phantom-deps	phantom-dep:@oclif/plugin-plugins	AI (phantom-deps): Declared as oclif plugin in config; not directly imported by design.	ai	2026/05/25
phantom-deps	phantom-dep:@saltcorn/common-code	AI (phantom-deps): Same-org dependency; may be transitively loaded; stable false positive.	ai	2026/05/25