@supernovaio/cli
Supernova.io Command Line Interface
14
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
seva-supernovaartufimtcevsupernova-cisusergiijiritrecakclxsupernovasn-filipdaniskoydus
Keywords
SupernovaDesign SystemsSupernovaioSDKDesign TokensTokensAssetsComponentsDocumentationCMS
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): fs-extra and @types/fs-extra are well-known, widely-used packages with no malicious history. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainers replaced by other Supernova-org accounts; consistent with org-internal handoff. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are all Supernova-org accounts; internal team rotation, not a takeover. | ai | |
| provenance | publisher-changed | AI (provenance): Transition to GitHub Actions publisher is a documented CI/CD migration pattern for this established CLI package. | ai | |
| dependencies | unvetted-dep:@supernovaio/code-analyzer | AI (dependencies): Same @supernovaio org namespace as the package itself; consistent with CLI tooling purpose. | ai | |
| provenance | no-provenance | AI (provenance): Established org CLI; no provenance has been a consistent pattern across versions. | ai | |
| dependencies | unvetted-dep:@supernovaio/sdk | AI (dependencies): First-party Supernova SDK dependency; expected for this CLI package. | ai | |
| dependencies | unvetted-dep:@hackolade/keytar | AI (dependencies): Keytar fork for credential storage; consistent with CLI auth use case. | ai | |
| dependencies | unvetted-dep:@supernova-studio/simple-parse-github-url | AI (dependencies): First-party Supernova utility; expected for this CLI package. | ai | |
| dependencies | unvetted-dep:@supernova-studio/pulsar-language | AI (dependencies): First-party Supernova dependency; expected for this CLI package. | ai | |
| dependencies | unvetted-dep:@supernova-studio/pulsar-core | AI (dependencies): First-party Supernova dependency; expected for this CLI package. | ai | |
| phantom-deps | phantom-dep:@supernova-studio/model | AI (phantom-deps): Bundled dep (listed in bundleDependencies); phantom-dep false positive. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @supernovaio/cli; levenshtein match to 'joi' is a false positive — no brand impersonation. | ai | |
| phantom-deps | phantom-dep:@supernova-studio/simple-parse-github-url | AI (phantom-deps): Bundled dep (listed in bundleDependencies); phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:colors | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:ip-cidr | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:minimatch | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:ts-pattern | AI (phantom-deps): Declared runtime dep; phantom-dep heuristic false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:@types/fs-extra | AI (phantom-deps): Types package loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@hackolade/keytar | AI (phantom-deps): Loaded indirectly via oclif/keytar integration; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-help | AI (phantom-deps): oclif plugin loaded by convention via oclif config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-plugins | AI (phantom-deps): oclif plugin loaded by convention via oclif config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@sentry/profiling-node | AI (phantom-deps): Sentry profiling loaded at runtime via Sentry integration; stable false positive. | ai |