forest-cli
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | dormant-publish | AI (publish-pattern): SLSA provenance attestation confirms CI/CD publish; dormancy likely reflects project lifecycle, not takeover. | ai | |
| dependencies | unvetted-dep:sequelize | AI (dependencies): sequelize is a well-known ORM; appropriate for this database-scaffolding CLI tool. | ai | |
| dependencies | unvetted-dep:handlebars | AI (dependencies): handlebars is a well-known templating library; appropriate for code generation in this CLI. | ai | |
| phantom-deps | phantom-dep:saslprep | AI (phantom-deps): MongoDB auth helper; declared dep, not directly imported by design. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): CLI framework dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:jsonwebtoken | AI (phantom-deps): Auth utility; declared dep, not directly imported by design. | ai | |
| phantom-deps | phantom-dep:app-root-path | AI (phantom-deps): Utility dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:stdout-stderr | AI (phantom-deps): Test utility dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): DB driver declared as optional dep for SQL scaffolding CLI; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-help | AI (phantom-deps): oclif plugin declared in oclif config, not directly imported; stable false positive. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-not-found | AI (phantom-deps): oclif plugin declared in oclif config, not directly imported; stable false positive. | ai | |
| phantom-deps | phantom-dep:@oclif/plugin-warn-if-update-available | AI (phantom-deps): oclif plugin declared in oclif config, not directly imported; stable false positive. | ai | |
| phantom-deps | phantom-dep:@paralleldrive/cuid2 | AI (phantom-deps): Utility dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:atob | AI (phantom-deps): Utility dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:mysql2 | AI (phantom-deps): DB driver declared as optional dep for SQL scaffolding CLI; not directly imported by design. | ai | |
| phantom-deps | phantom-dep:tedious | AI (phantom-deps): DB driver declared as optional dep for SQL scaffolding CLI; not directly imported by design. | ai |
Versions (showing 20 of 20)
| Version | Deps | Published |
|---|---|---|
| 5.3.11 | 39 / 33 | |
| 5.3.10 | 39 / 33 | |
| 5.3.9 | 39 / 33 | |
| 5.3.8 | 39 / 33 | |
| 5.3.7 | 39 / 33 | |
| 5.3.6 | 39 / 33 | |
| 5.3.5 | 39 / 33 | |
| 5.3.4 | 38 / 32 | |
| 5.3.3 | 38 / 32 | |
| 5.3.2 | 38 / 32 | |
| 5.3.1 | 38 / 32 | |
| 5.3.0 | 38 / 32 | |
| 5.2.2 | 38 / 32 | |
| 5.2.1 | 38 / 32 | |
| 5.2.0 | 38 / 32 | |
| 5.1.10 | 38 / 32 | |
| 5.1.9 | 38 / 32 | |
| 5.1.8 | 38 / 32 | |
| 5.1.7 | 38 / 32 | |
| 5.1.6 | 38 / 32 |
v5.3.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.5
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (vincentmolinieforest) on 2025-10-28, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v5.3.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (vincentmolinieforest) than the most recent previously approved version (forestbot) on 2025-10-23, but vincentmolinieforest is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v5.3.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.3.0
2 findingsThis version was published by a different npm account (forestbot) than the most recent previously approved version (arnaudbesnier) on 2025-02-26. It has since remained available on npm for 510 days without being unpublished, which is inconsistent with an account takeover — those are typically removed by npm shortly after discovery.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.2.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.