@code-recycle/cli
高级语法查询替换工具;Advanced syntax query replacement tool
4
Versions
—
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
wszgrcy
Keywords
ast querycss selectorparserparser bundlefindreplace@lezertree-sitterantlr4vueangularjsonc-parserpgsql-ast-parserhtmlparser2searchreplacelike
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): YAML binary tag handler in bundled yaml library. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Bundled ajv schema compiler; standard pattern. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Bundled debug library reading DEBUG_ env vars. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Angular devkit workspace proxy pattern; not obfuscation. | ai | |
| phantom-deps | phantom-dep:@angular/core | AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:zone.js | AI (phantom-deps): Angular peer dep loaded by convention alongside @angular/core; not a direct import by design. | ai | |
| phantom-deps | phantom-dep:@types/lodash | AI (phantom-deps): Type-only package; never directly imported at runtime. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped package @code-recycle/cli has no plausible relationship to joi; edit-distance match is a false positive for this long scoped name. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Expected for a CLI tool; no evidence of malicious use — import appears in standard Node.js built-in module mapping in webpack bundle. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): Fires in YAML parsing section of webpack bundle; consistent with YAML JS function tag support, not arbitrary code injection. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Fires on webpack bundle infrastructure and intentional hot-reload of user scripts (delete require.cache pattern); consistent with CLI tool's documented purpose. | ai |
Versions (showing 4 of 4)
| Version | Deps | Published |
|---|---|---|
| 1.3.14 | 29 / 0 | |
| 1.3.13 | 29 / 0 | |
| 1.3.12 | 28 / 0 | |
| 1.3.11 | 27 / 0 |
v1.3.14
1 finding
LOW
No provenance attestation
provenance
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.