← Home

@zendesk/zcli

npm Repository Homepage

Zendesk CLI is a single command line tool for all your zendesk needs

5
Versions
MIT
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

zdrsimzd-svc-npmjsakash.lahanesavya.singhraj.hawaldarneeraj.gupta-zendesk

Keywords

zclizendeskcommandcli

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-added AI (maintainer-change): Intra-org maintainer rotation; zd-svc-npmjs is a known Zendesk service account. ai
maintainer-change maintainer-removed AI (maintainer-change): Intra-org rotation; previous maintainer removed as part of service account transition. ai
publish-pattern dormant-publish AI (publish-pattern): Long-lived Zendesk CLI; dormancy followed by org service account publish is consistent with planned migration. ai
phantom-deps phantom-dep:@oclif/plugin-not-found AI (phantom-deps): oclif plugin loaded via config; not directly imported. ai
phantom-deps phantom-dep:@oclif/plugin-autocomplete AI (phantom-deps): oclif plugin loaded via config; not directly imported. ai
phantom-deps phantom-dep:@oclif/plugin-warn-if-update-available AI (phantom-deps): oclif plugin loaded via config; not directly imported. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): Implicit dependency of oclif framework; stable for this package. ai
phantom-deps phantom-dep:@zendesk/zcli-themes AI (phantom-deps): oclif plugin loaded via config; same-org scoped package. ai
phantom-deps phantom-dep:@zendesk/zcli-connectors AI (phantom-deps): oclif plugin loaded via config; same-org scoped package. ai
phantom-deps phantom-dep:@zendesk/zcli-apps AI (phantom-deps): oclif plugin loaded via config; same-org scoped package. ai
phantom-deps phantom-dep:@oclif/plugin-help AI (phantom-deps): oclif plugin loaded via config; not directly imported. ai
phantom-deps phantom-dep:@oclif/plugin-update AI (phantom-deps): oclif plugin loaded via config; not directly imported. ai

Versions (showing 5 of 5)

Version Deps Published
1.1.4 11 / 0
1.1.2 11 / 0
1.1.1 11 / 0
1.1.0 11 / 0
1.0.0 11 / 0

v1.1.4

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: zd-svc-npmjs → GitHub Actions (on 2026-07-20, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (zd-svc-npmjs) on 2026-07-20, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v1.1.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.