@stackone/cli
StackOne Connect CLI tool
27
Versions
ISC
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
s1guillaumejorge.stackonestackone-publisher
Keywords
stackonecliconnectintegration
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/cliCore-E8z0v8KP.cjs | AI (source-diff): Minified CLI bundle output from tsdown --minify; not obfuscated malware. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions CI publishing is a standard automation pattern; package.json publish-release script confirms intent. | ai | |
| source-diff | net-exec-file:dist/cliCore-D2QQhlz-.mjs | AI (source-diff): CLI tool legitimately uses child_process and network; pattern is expected for this package. | ai | |
| source-diff | obfuscated-file:dist/cliCore-D2QQhlz-.mjs | AI (source-diff): Minified CLI bundle output from tsdown --minify; not obfuscated malware. | ai | |
| source-diff | net-exec-file:dist/cliCore-E8z0v8KP.cjs | AI (source-diff): CLI tool legitimately uses child_process and network; pattern is expected for this package. | ai | |
| source-diff | obfuscated-file:dist/cliCore-_BZmg0kj.mjs | AI (source-diff): Standard tsdown minified CLI bundle (ESM variant); same rationale as CJS counterpart. | ai | |
| phantom-deps | phantom-dep:@stackone/expressions | AI (phantom-deps): Same-org dep bundled into dist; phantom detection is a false positive for this build pattern. | ai | |
| source-diff | obfuscated-file:dist/cliCore-DZnmJlqN.cjs | AI (source-diff): Standard tsdown minified CLI bundle; not obfuscated malware. Consistent with documented build config. | ai | |
| source-diff | obfuscated-file:dist/cliCore-CVaQgq11.cjs | AI (source-diff): Minified bundler output (tsdown --minify); readable logic, no malicious patterns. | ai | |
| phantom-deps | phantom-dep:@stackone/agent-harness | AI (phantom-deps): Same-org dep, visible in bundled dist imports. | ai | |
| phantom-deps | phantom-dep:@stackone/defender | AI (phantom-deps): Same-org dep, likely used via bundled dist output. | ai | |
| phantom-deps | phantom-dep:@anthropic-ai/sdk | AI (phantom-deps): Bundled into dist; not directly imported at module level but used transitively. | ai | |
| source-diff | obfuscated-file:dist/cliCore-Bil5LSaV.mjs | AI (source-diff): Minified bundler output (tsdown --minify); readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/agentConfig-BWQWMYKQ.mjs | AI (source-diff): Minified bundler output (tsdown --minify); readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/agentConfig-KBkYYmMr.cjs | AI (source-diff): Minified bundler output (tsdown --minify); readable logic, no malicious patterns. | ai | |
| source-diff | obfuscated-file:dist/cliCore-Zl15XKFp.mjs | AI (source-diff): ESM counterpart of the same minified build bundle; same rationale as the CJS file. | ai | |
| source-diff | obfuscated-file:dist/cliCore-HvFqMNSa.cjs | AI (source-diff): Standard tsdown --minify output; samples show normal CLI/React logic, no obfuscation or malicious payload. | ai | |
| source-diff | obfuscated-file:dist/cliCore-CGA-wigN.js | AI (source-diff): Minified ESM build output from tsdown --minify; same CLI logic as CJS counterpart. | ai | |
| source-diff | obfuscated-file:dist/cliCore-Bba3TFak.cjs | AI (source-diff): Minified build output from tsdown --minify; content is standard CLI logic, not obfuscated malware. | ai | |
| source-diff | obfuscated-file:dist/cliCore-BOwdDcP4.cjs | AI (source-diff): Minified build output from tsdown --minify; content is standard CLI logic, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/esm-BrK-ICga.cjs | AI (source-diff): Minified build output from tsdown --minify; content is readdirp-style file traversal, not malicious. | ai | |
| source-diff | obfuscated-file:dist/cliCore-CYhcPSJT.js | AI (source-diff): Minified build output from tsdown --minify; same CLI logic as .cjs counterpart. | ai | |
| source-diff | obfuscated-file:dist/esm-D_hUWJ1V.js | AI (source-diff): Minified build output from tsdown --minify; ESM counterpart of the file traversal module. | ai | |
| phantom-deps | phantom-dep:@stackone/connect-sdk | AI (phantom-deps): Same-org dep in bundled CLI; false positive for this package. | ai | |
| phantom-deps | phantom-dep:@stackone/agent-config | AI (phantom-deps): Same-org dep in bundled CLI; false positive for this package. | ai | |
| phantom-deps | phantom-dep:@stackone/transport | AI (phantom-deps): Same-org dep in bundled CLI; false positive for this package. | ai | |
| phantom-deps | phantom-dep:@stackone/core | AI (phantom-deps): Internal org package; bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:ink-spinner | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:consola | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:semver | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:@clack/prompts | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): Bundled CLI using ink (React renderer); resolved at build time. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:diff | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:ink | AI (phantom-deps): Bundled CLI; deps resolved at build time, not via direct import statements. | ai | |
| phantom-deps | phantom-dep:marked-terminal | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| phantom-deps | phantom-dep:@stackone/utils | AI (phantom-deps): Internal org package; bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:json-colorizer | AI (phantom-deps): Bundled CLI; deps resolved at build time. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall only writes a static markdown file to a sibling package dir; no network access or code execution. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @stackone/cli package; levenshtein match to 'joi' is a false positive with no impersonation intent. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 1.34.0 | 25 / 21 | |
| 1.31.1 | 24 / 21 | |
| 1.31.0 | 24 / 21 | |
| 1.30.0 | 24 / 21 | |
| 1.29.0 | 24 / 21 | |
| 1.28.0 | 24 / 21 | |
| 1.24.1 | 24 / 21 | |
| 1.24.0 | 23 / 21 | |
| 1.18.0 | 23 / 21 | |
| 1.17.0 | 23 / 21 | |
| 1.16.1 | 15 / 20 | |
| 1.15.2 | 14 / 20 | |
| 1.13.2 | 11 / 20 | |
| 1.8.1 | 6 / 1 | |
| 1.8.0 | 6 / 1 | |
| 1.7.0 | 6 / 1 | |
| 1.6.0 | 6 / 1 | |
| 1.5.0 | 5 / 1 | |
| 1.4.0 | 5 / 1 | |
| 1.3.0 | 5 / 1 | |
| 1.2.2 | 5 / 1 | |
| 1.2.1 | 5 / 1 | |
| 1.2.0 | 5 / 1 | |
| 1.1.1 | 5 / 1 | |
| 1.1.0 | 5 / 1 | |
| 1.0.1 | 4 / 1 | |
| 1.0.0 | 4 / 1 |