@nocobase/cli
<video width="100%" controls> <source src="https://github.com/user-attachments/assets/4d11a87b-00e2-48f3-9bf7-389d21072d13" type="video/mp4"> </video>
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Major CLI rewrite from commander to oclif; new files reflect legitimate architectural expansion. | ai | |
| phantom-deps | phantom-dep:@inquirer/type | AI (phantom-deps): Type-only package used for TypeScript type declarations; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:openapi-types | AI (phantom-deps): Type-only dependency used in config/type declarations; not directly imported at runtime. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase explained by oclif migration, bundled DB drivers, and interactive prompt libraries. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Monorepo sub-package CLI tool; documentation lives in the main project repo. README signals are expected for this package structure. | ai | |
| dependencies | unvetted-dep:pm2 | AI (dependencies): pm2 is a well-known, widely-used Node.js process manager. Legitimate dependency for a CLI tool. | ai | |
| dependencies | unvetted-dep:@umijs/utils | AI (dependencies): @umijs/utils is part of the established UmiJS ecosystem, used here for dev tooling. | ai | |
| dependencies | unvetted-dep:@nocobase/license-kit | AI (dependencies): First-party NocoBase license management package, consistent with the project's own ecosystem. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to parse npm CLI stdout (JS array literal) for version listing — input is controlled, not user-supplied. Stable pattern for this package. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @nocobase/cli is a scoped package for the NocoBase platform, not a typosquat of joi. Levenshtein comparison is a false positive on scoped package names. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads cronstrue locale files; input is constrained by a known langs map, not arbitrary user input. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Raw IP 127.0.0.1 is localhost used as a local dev proxy fallback. Completely benign for a development CLI tool. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into subprocess env is standard CLI dev tool behavior for forwarding shell environment to child processes. Not credential exfiltration. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): tsx is a TypeScript runner invoked by the CLI as a subprocess, not imported directly. Expected pattern. | ai | |
| phantom-deps | phantom-dep:@types/fs-extra | AI (phantom-deps): @types packages are type definitions used at compile time, not imported at runtime. Standard pattern. | ai | |
| phantom-deps | phantom-dep:pm2 | AI (phantom-deps): pm2 is used as a process manager at runtime by the CLI; phantom-dep detection is a false positive for this usage pattern. | ai |
Versions (showing 31 of 134)
| Version | Deps | Published |
|---|---|---|
| 1.9.28 | 17 / 1 | |
| 1.9.27 | 17 / 1 | |
| 1.9.26 | 17 / 1 | |
| 1.9.25 | 17 / 1 | |
| 1.9.24 | 17 / 1 | |
| 1.9.23 | 17 / 1 | |
| 1.9.22 | 17 / 1 | |
| 1.9.21 | 17 / 1 | |
| 1.9.20 | 17 / 1 | |
| 1.9.19 | 17 / 1 | |
| 1.9.18 | 17 / 1 | |
| 1.9.17 | 17 / 1 | |
| 1.9.16 | 17 / 1 | |
| 1.9.15 | 17 / 1 | |
| 1.9.14 | 17 / 1 | |
| 1.9.13 | 17 / 1 | |
| 1.9.12 | 17 / 1 | |
| 1.9.11 | 17 / 1 | |
| 1.9.10 | 17 / 1 | |
| 1.9.9 | 17 / 1 | |
| 1.9.8 | 17 / 1 | |
| 1.9.7 | 17 / 1 | |
| 1.9.6 | 17 / 1 | |
| 1.9.5 | 17 / 1 | |
| 1.9.4 | 17 / 1 | |
| 1.9.3 | 17 / 1 | |
| 1.9.2 | 17 / 1 | |
| 1.9.1 | 17 / 1 | |
| 1.9.0 | 17 / 1 | |
| 1.8.33 | 17 / 1 | |
| 1.8.32 | 17 / 1 |
v1.9.28
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.27
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.26
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.25
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.24
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.23
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.22
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.21
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.20
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.19
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.18
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.17
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.33
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.8.32
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.