@simplysm/sd-cli
Simplysm package - CLI tool
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): High-volume publisher with strong approval track record; likely CI environment change, not a supply-chain indicator. | ai | |
| dependencies | unvetted-dep:cordova | AI (dependencies): Legitimate build-time dep for Cordova mobile builds; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:electron-builder | AI (dependencies): Legitimate build-time dep for Electron packaging; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:esbuild-sass-plugin | AI (dependencies): Standard esbuild SASS plugin; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:specifier-resolution-node | AI (dependencies): ESM specifier resolution helper; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-storage | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-core-node | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-core-common | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-service-server | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| phantom-deps | phantom-dep:@angular/compiler | AI (phantom-deps): Framework-scoped package loaded by convention in Angular build CLI. | ai | |
| phantom-deps | phantom-dep:@electron/rebuild | AI (phantom-deps): Invoked as a build tool via config, not direct import. | ai | |
| phantom-deps | phantom-dep:specifier-resolution-node | AI (phantom-deps): Node resolution plugin used via config/subprocess, not direct import. | ai | |
| phantom-deps | phantom-dep:esbuild-sass-plugin | AI (phantom-deps): Build plugin referenced via config, not direct import. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into spawn() options is standard CLI practice; not credential exfiltration. | ai | |
| phantom-deps | phantom-dep:cordova | AI (phantom-deps): CLI tool invokes cordova as a subprocess/config dep, not via direct import. | ai | |
| phantom-deps | phantom-dep:electron | AI (phantom-deps): Electron is a build target invoked by the CLI, not directly imported. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Stable false positive for this CLI package; used via config/indirect reference. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Stable false positive; rxjs used transitively through @simplysm/* siblings. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency for TypeScript compilation output. | ai | |
| phantom-deps | phantom-dep:ts-morph | AI (phantom-deps): Used via config/indirect reference in this CLI tool. | ai | |
| phantom-deps | phantom-dep:sass-embedded | AI (phantom-deps): Build tool dependency invoked via config, not direct import. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 1312 versions; lack of provenance is consistent across all prior releases. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 14.0.87 | 29 / 6 | |
| 14.0.77 | 29 / 6 | |
| 14.0.71 | 29 / 6 | |
| 14.0.66 | 28 / 6 | |
| 14.0.64 | 28 / 6 | |
| 14.0.61 | 28 / 6 | |
| 14.0.58 | 28 / 6 | |
| 14.0.1 | 19 / 4 | |
| 12.16.52 | 32 / 2 | |
| 12.16.42 | 32 / 2 | |
| 12.16.41 | 32 / 2 | |
| 12.16.29 | 27 / 2 | |
| 12.16.24 | 27 / 2 | |
| 12.16.18 | 27 / 2 | |
| 12.14.5 | 26 / 4 |
v14.0.87
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: kslhunter.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.77
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: kslhunter.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.71
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: kslhunter.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.66
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: kslhunter.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.64
2 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: kslhunter.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.16.42
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.16.41
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.16.29
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.16.24
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.16.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v12.14.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.