@oclif/config — Greenflagged

base config object and standard interfaces for oclif components

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

anycli-botrodespmdonnalleyrasphilcodickeyxxxamphrochadiansalesforce-releases

Keywords

oclif

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): The added dependency is 'debug', one of the most trusted npm packages. This is a benign addition for a CLI config library.	ai	2026/04/23
maintainer-change	maintainer-added	AI (maintainer-change): anycli-bot is an oclif project automation account; adding bot maintainers is standard practice for this org and generalizes across versions.	ai	2026/04/23
provenance	missing-githead	AI (provenance): Established oclif package with long history; missing gitHead reflects a publish environment change, not a compromise signal for this well-known package.	ai	2026/04/23
publish-pattern	dormant-publish	AI (publish-pattern): Dormancy followed by a minor housekeeping release (moving conventional-changelog-cli to devDeps) is consistent with legitimate maintenance, not account takeover.	ai	2026/04/23
provenance	publisher-changed	AI (provenance): dickeyxxx is the original author (Jeff Dickey @jdxcode) returning to maintain their own package; the publisher change from rasphilco back to dickeyxxx is a legitimate transition.	ai	2026/04/23
phantom-deps	phantom-dep:conventional-changelog-cli	AI (phantom-deps): conventional-changelog-cli is used only in the 'version' npm lifecycle script for changelog generation; it's a misplaced devDependency, not a malicious phantom dep.	ai	2026/04/23
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is used for plugin/manifest loading in oclif's CLI framework — this is the intended design pattern, not a security risk.	ai	2026/04/21
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a standard TypeScript runtime helper; its use as an implicit dependency is expected and benign for TypeScript-compiled packages.	ai	2026/04/21

Versions (showing 51 of 131)

View all versions

Version	Deps	Published
1.18.17	6 / 18	2023-08-20
1.18.16	6 / 18	2023-07-30
1.18.15	6 / 18	2023-07-23
1.18.14	6 / 18	2023-07-19
1.18.13	6 / 18	2023-07-16
1.18.12	6 / 18	2023-07-11
1.18.11	6 / 18	2023-07-02
1.18.10	6 / 18	2023-06-04
1.18.9	6 / 18	2023-05-21
1.18.8	6 / 18	2023-01-29
1.18.7	6 / 18	2023-01-29
1.18.6	6 / 18	2022-11-06
1.18.5	6 / 18	2022-10-02
1.18.4	6 / 18	2022-10-01
1.18.3	6 / 18	2022-01-31
1.18.2	6 / 18	2021-12-06
1.18.1	6 / 18	2021-11-29
1.18.0	7 / 19	2021-11-29
1.17.1	6 / 18	2021-11-18
1.17.0	6 / 18	2020-08-03
1.16.0	6 / 18	2020-06-29
1.15.1	4 / 19	2020-04-14
1.15.0	4 / 19	2020-04-14
1.14.0	4 / 19	2020-02-06
1.13.3	3 / 19	2019-08-15
1.13.2	3 / 19	2019-07-11
1.13.1	3 / 19	2019-07-10
1.13.0	2 / 20	2019-05-09
1.12.12	2 / 20	2019-03-29
1.12.11	2 / 21	2019-03-20
1.12.10	2 / 21	2019-03-13
1.12.9	2 / 21	2019-02-28
1.12.8	2 / 21	2019-02-19
1.12.6	2 / 21	2019-02-11
1.12.4	2 / 21	2019-01-31
1.12.2	2 / 21	2019-01-30
1.12.0	2 / 19	2019-01-18
1.10.4	2 / 19	2018-12-27
1.10.3	2 / 19	2018-12-21
1.10.2	2 / 19	2018-12-18
1.10.0	3 / 18	2018-12-18
1.9.0	2 / 18	2018-11-07
1.8.8	2 / 18	2018-10-13
1.8.7	2 / 18	2018-10-13
1.8.6	2 / 18	2018-10-04
1.8.5	2 / 18	2018-10-04
1.8.4	2 / 18	2018-10-03
1.8.3	2 / 18	2018-10-03
1.8.2	2 / 18	2018-10-03
1.8.1	2 / 18	2018-10-02
1.8.0	2 / 18	2018-10-02

v1.18.15

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.18.1

2 findings

HIGH Publisher changed: rasphilco → salesforce-releases (on 2021-11-29) provenance

This version was published by a different npm account than previous versions on 2021-11-29. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.18.0

2 findings

HIGH Publisher changed: rasphilco → salesforce-releases (on 2021-11-29) provenance

This version was published by a different npm account than previous versions on 2021-11-29. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.17.1

2 findings

HIGH Publisher changed: rasphilco → salesforce-releases (on 2021-11-18) provenance

This version was published by a different npm account than previous versions on 2021-11-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.17.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.16.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chadian.

HIGH Publisher changed: rasphilco → chadian (on 2020-06-29) provenance

This version was published by a different npm account than previous versions on 2020-06-29. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.15.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: chadian.

HIGH Publisher changed: rasphilco → chadian (on 2020-04-14) provenance

This version was published by a different npm account than previous versions on 2020-04-14. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.14.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.2

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.1

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.13.0

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.12

2 findings

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-03-29) provenance

This version was published by a different npm account than previous versions on 2019-03-29. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.11

2 findings

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-03-20) provenance

This version was published by a different npm account than previous versions on 2019-03-20. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.10

2 findings

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-03-13) provenance

This version was published by a different npm account than previous versions on 2019-03-13. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.9

2 findings

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-02-28) provenance

This version was published by a different npm account than previous versions on 2019-02-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.8

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-02-19) provenance

This version was published by a different npm account than previous versions on 2019-02-19. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.6

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-02-11) provenance

This version was published by a different npm account than previous versions on 2019-02-11. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.4

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-01-31) provenance

This version was published by a different npm account than previous versions on 2019-01-31. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.2

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-01-30) provenance

This version was published by a different npm account than previous versions on 2019-01-30. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.12.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2019-01-18) provenance

This version was published by a different npm account than previous versions on 2019-01-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.4

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.3

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: rasphilco.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.2

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2018-12-18) provenance

This version was published by a different npm account than previous versions on 2018-12-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.10.0

3 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: dickeyxxx.

HIGH Publisher changed: rasphilco → dickeyxxx (on 2018-12-18) provenance

This version was published by a different npm account than previous versions on 2018-12-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.9.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.8.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.