← Home

instant-cli

npm Repository Homepage

Instant's CLI

100
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

stopachkanezajdwwdrew-h

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
maintainer-change maintainer-removed AI (maintainer-change): Maintainer removal is consistent with the transition to automated GitHub Actions publishing; SLSA attestation confirms the official repo is the source. ai
provenance publisher-changed AI (provenance): Publisher changed to GitHub Actions with SLSA provenance attestation from the official instantdb/instant repo — this reflects a legitimate CI/CD migration, not a compromise. ai
publish-pattern dormant-publish AI (publish-pattern): Package has SLSA provenance attestation confirming CI/CD publish; dormancy followed by legitimate feature release is consistent with this project's history. ai
phantom-deps phantom-dep:dotenv AI (phantom-deps): dotenv is a declared dependency used via config files; phantom detection is a false positive for this package. ai
phantom-deps phantom-dep:commander AI (phantom-deps): commander is a declared dependency; @commander-js/extra-typings wraps it. Phantom detection is a false positive here. ai
phantom-deps phantom-dep:ansi-escapes AI (phantom-deps): ansi-escapes is a declared dependency used indirectly; false positive for this package. ai
provenance slsa-provenance AI (provenance): instant-cli consistently publishes via CI/CD with SLSA provenance; this is a stable supply chain integrity signal for this package. ai
dependencies unvetted-dep:pkg-types AI (dependencies): pkg-types is a well-maintained UnJS package used by Vite, Nuxt, and many major tools. Not a security concern for this package. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding in an auth client module is a normal operation for decoding auth tokens/credentials. No obfuscation or malicious payload hiding evident. ai
semgrep semgrep:env-spread AI (semgrep): Flagged code is in a test helper (__tests__/e2e/helpers.ts) that spreads process.env to pass env vars to a child process — standard CLI test harness pattern, not a runtime risk. ai

Versions (showing 100 of 201)

Version Deps Published
1.0.52 31 / 11
1.0.51 31 / 11
1.0.50 31 / 11
1.0.49 31 / 11
1.0.48 31 / 11
1.0.47 31 / 11
1.0.46 31 / 11
1.0.45 31 / 11
1.0.44 31 / 11
1.0.43 31 / 11
1.0.42 31 / 11
1.0.41 31 / 11
1.0.40 31 / 11
1.0.39 31 / 11
1.0.38 31 / 11
1.0.37 31 / 11
1.0.36 31 / 11
1.0.35 31 / 11
1.0.34 31 / 11
1.0.33 31 / 11
1.0.32 31 / 11
1.0.31 31 / 11
1.0.30 31 / 11
1.0.29 31 / 11
1.0.28 31 / 11
1.0.27 31 / 11
1.0.26 31 / 11
1.0.25 31 / 11
1.0.24 31 / 11
1.0.23 31 / 11
1.0.22 31 / 11
1.0.21 31 / 11
1.0.20 31 / 11
1.0.19 31 / 11
1.0.18 31 / 11
1.0.17 31 / 11
1.0.16 31 / 11
1.0.15 31 / 11
1.0.14 31 / 11
1.0.13 31 / 11
1.0.12 31 / 11
1.0.11 31 / 11
1.0.10 31 / 11
1.0.9 31 / 11
1.0.8 31 / 11
1.0.7 31 / 11
1.0.6 31 / 11
1.0.5 30 / 10
1.0.4 30 / 10
1.0.3 30 / 10
1.0.2 30 / 10
1.0.1 30 / 10
1.0.0 30 / 10
0.22.185 30 / 10
0.22.184 30 / 10
0.22.183 30 / 10
0.22.182 30 / 10
0.22.181 30 / 10
0.22.180 30 / 10
0.22.179 30 / 10
0.22.178 30 / 10
0.22.177 24 / 8
0.22.175 24 / 8
0.22.174 24 / 8
0.22.173 24 / 8
0.22.172 24 / 8
0.22.171 24 / 8
0.22.169 24 / 8
0.22.168 24 / 8
0.22.167 24 / 8
0.22.166 24 / 8
0.22.165 24 / 8
0.22.164 24 / 8
0.22.163 24 / 8
0.22.162 24 / 8
0.22.161 24 / 8
0.22.160 24 / 8
0.22.159 24 / 8
0.22.158 24 / 8
0.22.157 24 / 8
0.22.156 23 / 8
0.22.155 23 / 8
0.22.154 23 / 8
0.22.153 23 / 8
0.22.152 23 / 8
0.22.151 23 / 8
0.22.150 23 / 8
0.22.149 23 / 8
0.22.148 23 / 8
0.22.147 23 / 8
0.22.146 23 / 8
0.22.145 23 / 8
0.22.144 23 / 8
0.22.143 23 / 8
0.22.142 23 / 8
0.22.141 23 / 8
0.22.140 23 / 8
0.22.139 23 / 8
0.22.138 23 / 8
0.22.137 23 / 8
Showing 100 of 201 Next page →

v1.0.52

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.51

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.50

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.