@angular/cli — Greenflagged

CLI tool for Angular

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

angulargoogle-wombot

Keywords

Angular CLIAngular DevKitangularangular-clidevkitsdk

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): zod and @modelcontextprotocol/sdk are established, legitimate packages added intentionally for Angular CLI's MCP server feature in v20.1.0. No malicious signal.	ai	2026/04/24
source-diff	large-new-source-files	AI (source-diff): Angular CLI regularly adds new source files with major/minor version bumps; 26 new files in a .3.0 release is consistent with active feature development (e.g., MCP tooling).	ai	2026/04/24
semgrep	semgrep:child-process-import	AI (semgrep): @angular/cli legitimately uses child_process to spawn build subprocesses and local CLI versions. This is expected, documented behavior for a CLI tool.	ai	2026/04/24
source-diff	net-exec-file:src/utilities/load-esm.js	AI (source-diff): Well-documented TypeScript workaround using new Function for dynamic import(); no actual network call. Standard Angular CLI pattern.	ai	2026/04/24
semgrep	semgrep:new-function-constructor	AI (semgrep): new Function used solely to preserve dynamic import() from TS downleveling; documented workaround in Angular CLI.	ai	2026/04/24
provenance	no-provenance	AI (provenance): Google-published Angular packages currently lack provenance; not a security concern given publisher trust level.	ai	2026/04/24
phantom-deps	phantom-dep:@schematics/angular	AI (phantom-deps): @schematics/angular is referenced in ng-update config for migrations, not directly imported in JS — expected pattern for Angular CLI.	ai	2026/04/23
typosquat	typosquat.levenshtein:joi	AI (typosquat): Scoped package @angular/cli has no relationship to joi; Levenshtein distance match is a structural false positive for long scoped names.	ai	2026/04/23
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require of project-local CLI is Angular CLI's documented version-resolution mechanism; stable and intentional.	ai	2026/04/23
semgrep	semgrep:env-spread	AI (semgrep): Spreading process.env into child process spawn options is standard practice in CLI tools for passing environment context.	ai	2026/04/23
semgrep	semgrep:base64-decode	AI (semgrep): AES-256-GCM decryption protects a read-only Algolia search API key for Angular docs; not malicious payload hiding.	ai	2026/04/23
semgrep	semgrep:env-bulk-read	AI (semgrep): Enumerating process.env for npm proxy/registry config is standard in package management tooling.	ai	2026/04/23

Versions (showing 51 of 165)

View all versions

Version	Deps	Published
21.2.13	18 / 0	2026-05-27
21.2.12	18 / 0	2026-05-20
21.2.11	18 / 0	2026-05-13
21.2.10	18 / 0	2026-05-06
21.2.9	18 / 0	2026-04-29
21.2.8	18 / 0	2026-04-22
21.2.7	18 / 0	2026-04-08
21.2.6	18 / 0	2026-04-01
21.2.5	18 / 0	2026-03-27
21.2.4	18 / 0	2026-03-26
21.2.3	18 / 0	2026-03-18
21.2.2	18 / 0	2026-03-11
21.2.1	18 / 0	2026-03-05
21.2.0	18 / 0	2026-02-25
21.1.5	19 / 0	2026-02-23
21.1.4	19 / 0	2026-02-11
21.1.3	19 / 0	2026-02-05
21.1.2	19 / 0	2026-01-28
21.1.1	19 / 0	2026-01-21
21.1.0	19 / 0	2026-01-14
21.0.6	19 / 0	2026-01-14
21.0.5	19 / 0	2026-01-07
21.0.4	19 / 0	2025-12-18
21.0.3	19 / 0	2025-12-10
21.0.2	19 / 0	2025-12-03
21.0.1	19 / 0	2025-11-26
21.0.0	19 / 0	2025-11-19
20.3.26	18 / 0	2026-05-13
20.3.25	18 / 0	2026-04-29
20.3.24	18 / 0	2026-04-15
20.3.23	18 / 0	2026-04-08
20.3.22	18 / 0	2026-03-27
20.3.21	18 / 0	2026-03-19
20.3.20	18 / 0	2026-03-11
20.3.19	18 / 0	2026-03-04
20.3.18	18 / 0	2026-02-26
20.3.17	18 / 0	2026-02-23
20.3.16	18 / 0	2026-02-09
20.3.15	18 / 0	2026-01-21
20.3.14	18 / 0	2026-01-07
20.3.13	18 / 0	2025-12-03
20.3.12	18 / 0	2025-11-25
20.3.11	18 / 0	2025-11-19
20.3.10	18 / 0	2025-11-12
20.3.9	18 / 0	2025-11-05
20.3.8	18 / 0	2025-10-29
20.3.7	18 / 0	2025-10-22
20.3.6	18 / 0	2025-10-15
20.3.5	18 / 0	2025-10-08
20.3.4	18 / 0	2025-10-02
20.3.3	18 / 0	2025-09-24

v21.2.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.10

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.9

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.8

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.0.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.26

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.25

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.24

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.23

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.22

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.21

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.20

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.19

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.18

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.17

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.16

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.7

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.6

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.5

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.3

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.