← Home

@npmcli/arborist

npm Repository Homepage

Manage node_modules trees

93
Versions
ISC
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

saquibkhannpm-cli-opsreggiowlstronaut

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance publisher-changed AI (provenance): Publisher change from lukekarrys to gar reflects normal maintainer rotation within npm Inc.; both are known npm organization members with strong track records. ai
provenance missing-githead AI (provenance): Trusted npm org publisher; missing gitHead is a CI environment artifact, not a supply chain indicator for this well-established package. ai
provenance no-provenance AI (provenance): Best-practice gap only; @npmcli/arborist is a core npm CLI package published by a trusted org maintainer with a long track record. ai
phantom-deps phantom-dep:json-parse-even-better-errors AI (phantom-deps): Package is declared in dependencies; not directly imported in all code paths is a false positive for this type of utility dep. ai
phantom-deps phantom-dep:hosted-git-info AI (phantom-deps): hosted-git-info is a declared runtime dependency in package.json; phantom-dep fires because it's referenced in config rather than directly imported in JS, not a real risk. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require in bin/index.js is a standard CLI command-loader pattern iterating over known local files; not arbitrary code execution. ai
maintainer-change maintainer-removed AI (maintainer-change): gar (Gar Adams) was a former npm team member; removal reflects routine team changes at GitHub Inc., not a hostile takeover. Package is officially maintained by GitHub Inc. ai

Versions (showing 93 of 193)

Version Deps Published
4.0.1 32 / 6
4.0.0 32 / 6
3.0.0 32 / 6
2.10.0 32 / 6
2.9.0 32 / 6
2.8.5 32 / 6
2.8.4 31 / 6
2.8.3 31 / 6
2.8.2 31 / 10
2.8.1 32 / 10
2.8.0 32 / 10
2.7.1 32 / 10
2.7.0 29 / 10
2.6.4 29 / 10
2.6.3 28 / 10
2.6.2 27 / 10
2.6.1 27 / 10
2.6.0 27 / 10
2.5.0 27 / 10
2.4.4 27 / 10
2.4.3 27 / 10
2.4.2 27 / 11
2.4.1 27 / 11
2.4.0 27 / 11
2.3.0 27 / 12
2.2.9 27 / 12
2.2.8 27 / 12
2.2.7 27 / 12
2.2.6 27 / 12
2.2.5 27 / 12
2.2.4 27 / 12
2.2.3 27 / 12
2.2.2 27 / 12
2.2.1 27 / 12
2.2.0 27 / 12
2.1.1 27 / 12
2.1.0 27 / 12
2.0.6 27 / 12
2.0.5 27 / 12
2.0.4 27 / 12
2.0.3 26 / 12
2.0.2 25 / 12
2.0.1 25 / 12
2.0.0 25 / 12
1.0.14 25 / 10
1.0.13 25 / 10
1.0.12 25 / 10
1.0.11 25 / 10
1.0.10 25 / 10
1.0.9 25 / 10
1.0.8 24 / 10
1.0.7 24 / 10
1.0.6 24 / 10
1.0.5 24 / 10
1.0.4 24 / 10
1.0.3 24 / 10
1.0.2 24 / 10
1.0.1 24 / 10
1.0.0 24 / 10
0.0.33 24 / 10
0.0.32 24 / 10
0.0.31 24 / 10
0.0.30 24 / 10
0.0.29 24 / 10
0.0.28 23 / 10
0.0.27 23 / 5
0.0.26 23 / 5
0.0.25 23 / 5
0.0.24 22 / 5
0.0.23 22 / 5
0.0.22 22 / 5
0.0.21 22 / 5
0.0.20 22 / 5
0.0.19 21 / 5
0.0.18 21 / 5
0.0.17 21 / 5
0.0.16 21 / 5
0.0.15 21 / 5
0.0.14 21 / 5
0.0.13 21 / 5
0.0.12 21 / 5
0.0.11 21 / 5
0.0.10 21 / 5
0.0.9 21 / 5
0.0.8 21 / 5
0.0.7 21 / 5
0.0.6 21 / 5
0.0.5 21 / 5
0.0.4 21 / 5
0.0.3 21 / 5
0.0.2 21 / 5
0.0.1 21 / 5
0.0.0 21 / 5