zx
A tool for writing better scripts
1
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
medvgoogle-wombot
Keywords
bashbinbinarycallchildchild_processexecexecuteinvokepipeprocessscriptshellspawnzx
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:pg | AI (typosquat): zx is a legitimate, well-known Google scripting tool; 2-char name proximity to 'pg' is a Levenshtein artifact, not impersonation. | ai | |
| typosquat | typosquat.levenshtein:qs | AI (typosquat): zx is a legitimate, well-known Google scripting tool; 2-char name proximity to 'qs' is a Levenshtein artifact, not impersonation. | ai | |
| typosquat | typosquat.levenshtein:zod | AI (typosquat): zx is a legitimate, well-known Google scripting tool; 2-char name proximity to 'zod' is a Levenshtein artifact, not impersonation. | ai |
Versions (showing 1 of 1)
| Version | Deps | Published |
|---|---|---|
| 8.8.5 | 0 / 0 |
v8.8.5
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.