← Home

instant-cli

npm Repository Homepage

Instant's CLI

51
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

stopachkanezajdwwdrew-h

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Maintainer removal is consistent with the transition to automated GitHub Actions publishing; SLSA attestation confirms the official repo is the source. ai
provenance publisher-changed AI (provenance): Publisher changed to GitHub Actions with SLSA provenance attestation from the official instantdb/instant repo — this reflects a legitimate CI/CD migration, not a compromise. ai
publish-pattern dormant-publish AI (publish-pattern): Package has SLSA provenance attestation confirming CI/CD publish; dormancy followed by legitimate feature release is consistent with this project's history. ai
phantom-deps phantom-dep:dotenv AI (phantom-deps): dotenv is a declared dependency used via config files; phantom detection is a false positive for this package. ai
phantom-deps phantom-dep:commander AI (phantom-deps): commander is a declared dependency; @commander-js/extra-typings wraps it. Phantom detection is a false positive here. ai
phantom-deps phantom-dep:ansi-escapes AI (phantom-deps): ansi-escapes is a declared dependency used indirectly; false positive for this package. ai
provenance slsa-provenance AI (provenance): instant-cli consistently publishes via CI/CD with SLSA provenance; this is a stable supply chain integrity signal for this package. ai
dependencies unvetted-dep:pkg-types AI (dependencies): pkg-types is a well-maintained UnJS package used by Vite, Nuxt, and many major tools. Not a security concern for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding in an auth client module is a normal operation for decoding auth tokens/credentials. No obfuscation or malicious payload hiding evident. ai
semgrep semgrep:env-spread AI (semgrep): Flagged code is in a test helper (__tests__/e2e/helpers.ts) that spreads process.env to pass env vars to a child process — standard CLI test harness pattern, not a runtime risk. ai

Versions (showing 51 of 201)

View all versions
Version Deps Published
1.0.52 31 / 11
1.0.51 31 / 11
1.0.50 31 / 11
1.0.49 31 / 11
1.0.48 31 / 11
1.0.47 31 / 11
1.0.46 31 / 11
1.0.45 31 / 11
1.0.44 31 / 11
1.0.43 31 / 11
1.0.42 31 / 11
1.0.41 31 / 11
1.0.40 31 / 11
1.0.39 31 / 11
1.0.38 31 / 11
1.0.37 31 / 11
1.0.36 31 / 11
1.0.35 31 / 11
1.0.34 31 / 11
1.0.33 31 / 11
1.0.32 31 / 11
1.0.31 31 / 11
1.0.30 31 / 11
1.0.29 31 / 11
1.0.28 31 / 11
1.0.27 31 / 11
1.0.26 31 / 11
1.0.25 31 / 11
1.0.24 31 / 11
1.0.23 31 / 11
1.0.22 31 / 11
1.0.21 31 / 11
1.0.20 31 / 11
1.0.19 31 / 11
1.0.18 31 / 11
1.0.17 31 / 11
1.0.16 31 / 11
1.0.15 31 / 11
1.0.14 31 / 11
1.0.13 31 / 11
1.0.12 31 / 11
1.0.11 31 / 11
1.0.10 31 / 11
1.0.9 31 / 11
1.0.8 31 / 11
1.0.7 31 / 11
1.0.6 31 / 11
1.0.5 30 / 10
1.0.4 30 / 10
1.0.3 30 / 10
1.0.2 30 / 10

v1.0.52

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.51

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.50

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.