@storybook/cli
Storybook CLI: Develop, document, and test UI components in isolation
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/_node-chunks/run-DVQQ4AMZ.js | AI (source-diff): esbuild bundle output with CJS-compat banner; not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-DVQQ4AMZ.js | AI (source-diff): CLI bundle combining network+exec helpers for legitimate upgrade/init flows, not a dropper. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-LQKBOGSB.js | AI (source-diff): CLI bundle chunk; no concrete malicious network/exec behavior shown. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-LQKBOGSB.js | AI (source-diff): esbuild bundler output with CJS-compat banner, not true obfuscation. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-ILJ75WCL.js | AI (source-diff): CLI upgrader bundle; net+exec is normal for the tool, no hostile target. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-ILJ75WCL.js | AI (source-diff): esbuild bundle output with Storybook CJS-compat banner; minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-5HTDOUF4.js | AI (source-diff): CLI upgrade/codemod runner legitimately uses network + exec; bundled first-party code. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-5HTDOUF4.js | AI (source-diff): esbuild-bundled CLI output with CJS-compat banner; minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-TXXHENH7.js | AI (source-diff): CLI codegen bundle; dual-use net/exec with no hostile target. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-TXXHENH7.js | AI (source-diff): esbuild bundle output with Storybook compat banner; minified not obfuscated. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-UOXW6XFP.js | AI (source-diff): CLI bundle; process/network use is inherent to Storybook CLI, no hostile target. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-UOXW6XFP.js | AI (source-diff): esbuild bundle output with CJS-compat banner; minified, not obfuscated. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-RM7XIKWA.js | AI (source-diff): CLI tool legitimately uses network + exec (e.g. init, upgrade); bundled build output. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-RM7XIKWA.js | AI (source-diff): esbuild-bundled output with CJS compat banner; standard Storybook build artifact. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-ZB635R4G.js | AI (source-diff): CLI tool legitimately uses network + exec for scaffolding; bundled output triggers false positive. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-ZB635R4G.js | AI (source-diff): esbuild-bundled output with CJS compat banner; standard for Storybook CLI builds. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-BMVOW3UH.js | AI (source-diff): esbuild-bundled output with long lines; standard for this package's build pipeline. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-BMVOW3UH.js | AI (source-diff): CLI tool legitimately uses network + child_process; bundled output triggers false positive. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-LBK7OPAR.js | AI (source-diff): CLI tool legitimately uses network + child_process; bundled output, not malware. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-LBK7OPAR.js | AI (source-diff): esbuild-bundled output with CJS compat banner; expected for this package. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-EOEEHPMX.js | AI (source-diff): CLI tool legitimately uses network + exec; esbuild bundle, not malware. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-EOEEHPMX.js | AI (source-diff): esbuild-bundled output with CJS compat banner; standard Storybook build artifact. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-YXTQBW3D.js | AI (source-diff): esbuild-bundled output with CJS compat banner; standard Storybook build artifact. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-YXTQBW3D.js | AI (source-diff): CLI tool legitimately uses network + child_process; bundled output, not malicious. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-CMSUW4EI.js | AI (source-diff): esbuild-bundled output for Storybook CLI; minified chunks are expected. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Normal churn for a large CLI tool rebundled with esbuild across versions. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-CMSUW4EI.js | AI (source-diff): CLI tool legitimately uses network + exec (e.g. init, upgrade); bundled output. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-7LEO2IWT.js | AI (source-diff): esbuild-bundled output with CJS compat banner; standard for Storybook's build pipeline. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Monorepo automated release; expected for @storybook packages. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-7LEO2IWT.js | AI (source-diff): CLI tool legitimately uses network + exec; bundled output, not a dropper. | ai | |
| phantom-deps | phantom-dep:@babel/preset-env | AI (phantom-deps): @babel/preset-env is a framework-scoped package loaded by convention in Storybook's build pipeline; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/semver | AI (phantom-deps): @types/semver is a type declaration package loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:jscodeshift | AI (phantom-deps): jscodeshift is a legitimate declared dependency used by convention in the CLI's codemod tooling, not a phantom dep. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @storybook/cli is a well-established scoped package with 3000+ days of history; Levenshtein match against 'joi' is a false positive with no plausible typosquat relationship. | ai | |
| source-diff | net-exec-file:dist/_node-chunks/run-UE2YPBJ7.js | AI (source-diff): Network + code execution is expected for a CLI tool that upgrades Storybook dependencies, fetches npm package data, and runs codemods. The sample shows legitimate Storybook CLI functionality. | ai | |
| source-diff | obfuscated-file:dist/_node-chunks/run-UE2YPBJ7.js | AI (source-diff): Storybook CLI ships esbuild-bundled dist chunks with long lines; this is standard build output, not obfuscation. The CJS compat banner and named Storybook function imports confirm legitimate bundled code. | ai |
Versions (showing 51 of 497)
| Version | Deps | Published |
|---|---|---|
| 10.5.5 | 7 / 17 | |
| 10.5.4 | 7 / 17 | |
| 10.5.3 | 7 / 17 | |
| 10.5.2 | 7 / 17 | |
| 10.5.1 | 7 / 17 | |
| 10.5.0 | 7 / 17 | |
| 10.4.6 | 7 / 15 | |
| 10.4.5 | 7 / 15 | |
| 10.4.4 | 7 / 15 | |
| 10.4.3 | 7 / 15 | |
| 10.4.2 | 7 / 15 | |
| 10.4.1 | 7 / 15 | |
| 10.4.0 | 7 / 15 | |
| 10.3.6 | 7 / 14 | |
| 10.3.5 | 7 / 14 | |
| 10.3.4 | 7 / 14 | |
| 10.3.3 | 7 / 14 | |
| 10.3.2 | 7 / 14 | |
| 10.3.1 | 7 / 14 | |
| 10.3.0 | 7 / 14 | |
| 10.2.19 | 7 / 14 | |
| 10.2.18 | 7 / 14 | |
| 10.2.17 | 7 / 14 | |
| 10.2.16 | 7 / 14 | |
| 10.2.15 | 7 / 14 | |
| 10.2.14 | 7 / 14 | |
| 10.2.13 | 7 / 14 | |
| 10.2.12 | 7 / 14 | |
| 10.2.11 | 7 / 14 | |
| 10.2.10 | 7 / 14 | |
| 10.2.9 | 7 / 14 | |
| 10.2.8 | 7 / 14 | |
| 10.2.7 | 7 / 14 | |
| 10.2.6 | 7 / 14 | |
| 10.2.5 | 7 / 14 | |
| 10.2.4 | 7 / 14 | |
| 10.2.3 | 7 / 14 | |
| 10.2.2 | 7 / 14 | |
| 10.2.1 | 7 / 14 | |
| 10.2.0 | 7 / 14 | |
| 10.1.11 | 7 / 14 | |
| 10.1.10 | 7 / 14 | |
| 10.1.9 | 7 / 14 | |
| 10.1.8 | 7 / 14 | |
| 10.1.7 | 7 / 14 | |
| 10.1.6 | 7 / 14 | |
| 10.1.5 | 7 / 14 | |
| 10.1.4 | 7 / 14 | |
| 10.1.3 | 7 / 14 | |
| 10.1.2 | 7 / 14 | |
| 10.1.1 | 7 / 14 |
v10.5.5
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.5.4
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.5.3
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.5.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.5.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v10.5.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.