@titanpl/cli
The unified CLI for Titan Planet. Use it to create, manage, build, and deploy high-performance backend projects.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): CLI tool spawning child processes with process.env passthrough is standard; not exfiltration. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @titanpl/cli is not a typosquat of joi; Levenshtein match is spurious. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): Declared but not directly imported; likely used transitively or in config; stable false positive. | ai |
v7.0.8
4 findingsSpreading entire process.env into an object — may capture all secrets 138 | const engineProcess = spawn(binaryPath, args, { 139 | stdio: ['inherit', 'pipe', 'pipe'], > 140 | env: { 141 | ...process.env, 142 | TITAN_ENV: watchMode ? 'development' : 'production',
Spreading entire process.env into an object — may capture all secrets 138 | cwd: serverPath, 139 | stdio: ["ignore", "pipe", "pipe"], > 140 | env: { ...process.env, CARGO_INCREMENTAL: "1" } 141 | }); 142 |
Spreading entire process.env into an object — may capture all secrets 142 | cwd: serverPath, 143 | stdio: ["ignore", "pipe", "pipe"], > 144 | env: { ...process.env, CARGO_INCREMENTAL: "1" } 145 | }); 146 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v7.0.3
4 findingsSpreading entire process.env into an object — may capture all secrets 138 | const engineProcess = spawn(binaryPath, args, { 139 | stdio: ['inherit', 'pipe', 'pipe'], > 140 | env: { 141 | ...process.env, 142 | TITAN_ENV: watchMode ? 'development' : 'production',
Spreading entire process.env into an object — may capture all secrets 138 | cwd: serverPath, 139 | stdio: ["ignore", "pipe", "pipe"], > 140 | env: { ...process.env, CARGO_INCREMENTAL: "1" } 141 | }); 142 |
Spreading entire process.env into an object — may capture all secrets 142 | cwd: serverPath, 143 | stdio: ["ignore", "pipe", "pipe"], > 144 | env: { ...process.env, CARGO_INCREMENTAL: "1" } 145 | }); 146 |
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.0.1
2 findingsSpreading entire process.env into an object — may capture all secrets 91 | const engineProcess = spawn(binaryPath, args, { 92 | stdio: ['inherit', 'pipe', 'pipe'], > 93 | env: { 94 | ...process.env, 95 | TITAN_ENV: watchMode ? 'development' : 'production',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.