@simplysm/sd-cli
Simplysm package - CLI tool
18
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
kslhunter
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): High-volume publisher with strong approval track record; likely CI environment change, not a supply-chain indicator. | ai | |
| dependencies | unvetted-dep:cordova | AI (dependencies): Legitimate build-time dep for Cordova mobile builds; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:electron-builder | AI (dependencies): Legitimate build-time dep for Electron packaging; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:esbuild-sass-plugin | AI (dependencies): Standard esbuild SASS plugin; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:specifier-resolution-node | AI (dependencies): ESM specifier resolution helper; stable for this CLI tool. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-storage | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-core-node | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-core-common | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| dependencies | unvetted-dep:@simplysm/sd-service-server | AI (dependencies): Same-monorepo sibling package from trusted publisher kslhunter. | ai | |
| phantom-deps | phantom-dep:@angular/compiler | AI (phantom-deps): Framework-scoped package loaded by convention in Angular build CLI. | ai | |
| phantom-deps | phantom-dep:@electron/rebuild | AI (phantom-deps): Invoked as a build tool via config, not direct import. | ai | |
| phantom-deps | phantom-dep:specifier-resolution-node | AI (phantom-deps): Node resolution plugin used via config/subprocess, not direct import. | ai | |
| phantom-deps | phantom-dep:esbuild-sass-plugin | AI (phantom-deps): Build plugin referenced via config, not direct import. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into spawn() options is standard CLI practice; not credential exfiltration. | ai | |
| phantom-deps | phantom-dep:cordova | AI (phantom-deps): CLI tool invokes cordova as a subprocess/config dep, not via direct import. | ai | |
| phantom-deps | phantom-dep:electron | AI (phantom-deps): Electron is a build target invoked by the CLI, not directly imported. | ai | |
| phantom-deps | phantom-dep:glob | AI (phantom-deps): Stable false positive for this CLI package; used via config/indirect reference. | ai | |
| phantom-deps | phantom-dep:rxjs | AI (phantom-deps): Stable false positive; rxjs used transitively through @simplysm/* siblings. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): Known implicit runtime dependency for TypeScript compilation output. | ai | |
| phantom-deps | phantom-dep:ts-morph | AI (phantom-deps): Used via config/indirect reference in this CLI tool. | ai | |
| phantom-deps | phantom-dep:sass-embedded | AI (phantom-deps): Build tool dependency invoked via config, not direct import. | ai | |
| provenance | no-provenance | AI (provenance): Established package with 1312 versions; lack of provenance is consistent across all prior releases. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 14.2.3 | 28 / 7 | |
| 14.2.2 | 28 / 7 | |
| 14.2.1 | 28 / 7 | |
| 14.0.87 | 29 / 6 | |
| 14.0.77 | 29 / 6 | |
| 14.0.71 | 29 / 6 | |
| 14.0.66 | 28 / 6 | |
| 14.0.64 | 28 / 6 | |
| 14.0.61 | 28 / 6 | |
| 14.0.58 | 28 / 6 | |
| 14.0.1 | 19 / 4 | |
| 12.16.52 | 32 / 2 | |
| 12.16.42 | 32 / 2 | |
| 12.16.41 | 32 / 2 | |
| 12.16.29 | 27 / 2 | |
| 12.16.24 | 27 / 2 | |
| 12.16.18 | 27 / 2 | |
| 12.14.5 | 26 / 4 |
v14.2.3
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.2.2
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.2.1
1 finding
INFO
No provenance attestation
provenance
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.