@tinycloud/cli
TinyCloud CLI - manage data, delegations, and nodes from the terminal
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@tinycloud/operations | AI (dependencies): First-party sibling package from same org, not an unrelated third party. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps are first-party sibling and well-known siwe library. | ai | |
| source-diff | obfuscated-file:dist/ccip-ID23WCLC.js | AI (source-diff): Bundled ESM output from abitype/viem; readable imports and standard library code, not obfuscation. | ai | |
| source-diff | encoded-string-file:dist/index.js | AI (source-diff): Long base64 string is @ethersproject/hash ENS normalization compressed Unicode data, a well-known pattern. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects newly bundled crypto/ABI dependencies (abitype, viem chunks), not injected payloads. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped @tinycloud package; Levenshtein match to 'joi' is coincidental, not a typosquat. | ai |
Versions (showing 27 of 27)
| Version | Deps | Published |
|---|---|---|
| 0.8.1 | 8 / 3 | |
| 0.8.0 | 8 / 3 | |
| 0.7.8 | 8 / 3 | |
| 0.7.7 | 8 / 3 | |
| 0.7.6 | 6 / 3 | |
| 0.7.5 | 6 / 3 | |
| 0.7.4 | 6 / 3 | |
| 0.7.3 | 6 / 3 | |
| 0.7.2 | 6 / 3 | |
| 0.7.1 | 6 / 3 | |
| 0.7.0 | 6 / 3 | |
| 0.6.0 | 6 / 3 | |
| 0.5.0 | 6 / 3 | |
| 0.4.7 | 6 / 3 | |
| 0.4.6 | 6 / 3 | |
| 0.4.5 | 6 / 3 | |
| 0.4.3 | 6 / 3 | |
| 0.4.2 | 6 / 3 | |
| 0.4.1 | 6 / 3 | |
| 0.4.0 | 6 / 3 | |
| 0.3.1 | 6 / 3 | |
| 0.3.0 | 6 / 3 | |
| 0.2.0 | 6 / 3 | |
| 0.1.1 | 5 / 3 | |
| 0.1.0 | 5 / 3 | |
| 0.0.2 | 5 / 3 | |
| 0.0.1 | 5 / 3 |
v0.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.2
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.1
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.