cli
A tool for rapidly building command line apps
2
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
cohara87
Keywords
clicommand lineoptsparseoptoptargsconsoleargsparseoptparseautocompletecommandautocompletion
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:child-process-import | AI (semgrep): cli is a CLI framework that intentionally exposes exec() functionality; child_process import is expected and documented behavior for this package. | ai | |
| semgrep | semgrep:child-process-exec | AI (semgrep): cli.exec() is a core documented feature of this CLI framework; child_process.exec usage is intentional and expected. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used for lazy-loading native modules by name — a standard pattern in this CLI framework, not a malicious signal. | ai |