@truenine/memory-sync-cli
TrueNine Memory Synchronization CLI metadata package
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:remark-frontmatter | AI (phantom-deps): Remark plugin for YAML frontmatter; indirect through unified ecosystem. | ai | |
| phantom-deps | phantom-dep:remark-parse | AI (phantom-deps): Remark parser; indirect usage through unified markdown processing pipeline. | ai | |
| phantom-deps | phantom-dep:@clack/prompts | AI (phantom-deps): Interactive CLI prompts library; legitimate indirect usage in CLI tool. | ai | |
| phantom-deps | phantom-dep:remark-stringify | AI (phantom-deps): Remark serializer; indirect usage through unified markdown processing. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): Legitimate indirect dependency used through remark ecosystem and config processing in CLI tool. | ai | |
| phantom-deps | phantom-dep:unified | AI (phantom-deps): Core remark ecosystem dependency; used indirectly through remark-parse/stringify plugins. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Logging library; typical indirect usage pattern in CLI tools via plugin system. | ai | |
| phantom-deps | phantom-dep:fs-extra | AI (phantom-deps): File system utility; commonly used indirectly in build/CLI tools. | ai | |
| phantom-deps | phantom-dep:fast-glob | AI (phantom-deps): Glob pattern matching; indirect usage in file discovery patterns for CLI. | ai | |
| phantom-deps | phantom-dep:picomatch | AI (phantom-deps): Pattern matching utility; indirect dependency of fast-glob and CLI matching logic. | ai | |
| phantom-deps | phantom-dep:picocolors | AI (phantom-deps): Terminal color utility; indirect usage in CLI output formatting. | ai | |
| phantom-deps | phantom-dep:remark-gfm | AI (phantom-deps): Remark plugin for GitHub-flavored markdown; indirect through unified ecosystem. | ai | |
| source-diff | net-exec-file:dist/babel.cjs | AI (source-diff): Network+exec pattern is from bundled Babel/webpack runtime internals (dynamic require, module resolution). Not dropper/loader malware. | ai | |
| source-diff | obfuscated-file:dist/jiti-B3PPFIgr.mjs | AI (source-diff): dist/jiti-B3PPFIgr.mjs is a bundled jiti/mlly runtime. Long lines are minified bundle output from tsdown/rollup, not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/babel.cjs | AI (source-diff): dist/babel.cjs is a webpack-bundled Babel toolchain runtime. Long lines are minified bundle output, not obfuscation. Expected artifact for a CLI tool bundling its dependencies. | ai |
Versions (showing 39 of 139)
| Version | Deps | Published |
|---|---|---|
| 2026.10116.11129 | 14 / 15 | |
| 2026.10116.102 | 14 / 15 | |
| 2026.10107.106 | 14 / 15 | |
| 2026.10107.0 | 14 / 15 | |
| 2026.10106.107 | 14 / 15 | |
| 2026.10105.0 | 14 / 13 | |
| 2026.10103.10509 | 12 / 13 | |
| 2026.10103.10253 | 12 / 13 | |
| 2026.1.3 | 12 / 13 | |
| 2026.1.0 | 12 / 13 | |
| 2026.0.0 | 12 / 13 | |
| 2025.12.3119 | 12 / 13 | |
| 2025.12.2919 | 12 / 13 | |
| 2025.12.29 | 12 / 13 | |
| 2025.12.28 | 12 / 13 | |
| 2025.12.27 | 12 / 13 | |
| 1.0.5 | 12 / 13 | |
| 1.0.4 | 12 / 13 | |
| 1.0.3 | 12 / 13 | |
| 1.0.2 | 12 / 13 | |
| 1.0.0 | 12 / 13 | |
| 0.0.19 | 12 / 13 | |
| 0.0.18 | 12 / 13 | |
| 0.0.17 | 12 / 13 | |
| 0.0.16 | 12 / 13 | |
| 0.0.15 | 12 / 13 | |
| 0.0.14 | 12 / 13 | |
| 0.0.13 | 12 / 13 | |
| 0.0.12 | 12 / 13 | |
| 0.0.11 | 12 / 13 | |
| 0.0.10 | 12 / 13 | |
| 0.0.9 | 12 / 13 | |
| 0.0.8 | 12 / 13 | |
| 0.0.7 | 12 / 13 | |
| 0.0.6 | 12 / 13 | |
| 0.0.5 | 12 / 13 | |
| 0.0.4 | 12 / 13 | |
| 0.0.3 | 12 / 13 | |
| 0.0.1 | 12 / 13 |
v2026.10116.11129
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.10116.102
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.10107.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.10106.107
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.10105.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.10103.10509
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.10103.10253
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2025.12.3119
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2025.12.29
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2025.12.28
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2025.12.27
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.