← Home

@oclif/core

npm Repository Homepage

base library for oclif CLIs

51
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

mdonnalleysalesforce-releases

Keywords

oclifclicommandcommand lineparserargsargv

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern dormant-publish AI (publish-pattern): Salesforce-maintained package with 454 versions and strong track record; periodic dormancy between releases is normal for stable CLI framework libraries. ai
semgrep semgrep:toplevel-fetch AI (semgrep): Top-level fetch in CLI config initialization is a legitimate pattern; no evidence of exfiltration. ai
phantom-deps phantom-dep:@types/cli-progress AI (phantom-deps): TypeScript type definitions loaded by convention; expected for @types/* packages in CLI frameworks. ai
dependencies unvetted-dep:@types/cli-progress AI (dependencies): Type definitions for established cli-progress package; legitimate dev-time dependency. ai
source-diff large-new-source-files AI (source-diff): 76 new files expected for major version rewrite of oclif framework; legitimate TypeScript source expansion. ai
publish-pattern new-deps-added AI (publish-pattern): minimatch@^9.0.3 is an established, widely-trusted glob pattern library; legitimate addition for CLI framework. ai
maintainer-change maintainer-removed AI (maintainer-change): Maintainer removal without new maintainers is normal in mature projects; no takeover signal. ai
provenance no-provenance AI (provenance): Provenance absence is a best-practice gap, not a security issue for this established package. ai
semgrep semgrep:new-function-constructor AI (semgrep): The new Function() call is a documented CJS/ESM interop workaround for dynamic import() in TypeScript-compiled code. Input is a resolved module path, not arbitrary user input. Stable pattern for this package. ai
phantom-deps phantom-dep:tslib AI (phantom-deps): tslib is explicitly declared as a runtime dependency in package.json. This is a false positive; tslib is a standard TypeScript runtime helper used by this package. ai
dependencies unvetted-dep:ejs AI (dependencies): ejs is a standard, legitimate templating library; appropriate dependency for CLI framework. ai
dependencies unvetted-dep:ansi-escapes AI (dependencies): ansi-escapes is a legitimate, widely-used terminal utility; stable dependency for this CLI framework. ai
typosquat typosquat.levenshtein:cors AI (typosquat): Scoped @oclif package; Levenshtein match to 'cors' is coincidental, not typosquatting. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require of ts-node is a standard pattern in CLI frameworks for optional TypeScript support; constrained to known module, not arbitrary code execution. ai

Versions (showing 51 of 168)

View all versions
Version Deps Published
4.11.4 18 / 40
4.11.3 18 / 40
4.11.2 18 / 39
4.11.1 18 / 39
4.11.0 18 / 39
4.10.6 18 / 39
4.10.5 18 / 39
4.10.4 18 / 39
4.10.3 18 / 39
4.10.2 18 / 39
4.10.1 18 / 39
4.10.0 18 / 39
4.9.0 18 / 39
4.8.4 18 / 39
4.8.3 18 / 39
4.8.2 18 / 39
4.8.1 18 / 39
4.8.0 18 / 39
4.7.2 18 / 39
4.7.1 18 / 39
4.7.0 18 / 39
4.6.0 18 / 39
4.5.6 18 / 39
4.5.5 18 / 39
4.5.4 18 / 39
4.5.3 18 / 39
4.5.2 18 / 39
4.5.1 18 / 39
4.5.0 18 / 39
4.4.1 18 / 39
4.4.0 18 / 39
4.3.3 18 / 39
4.3.2 18 / 39
4.3.1 18 / 39
4.3.0 18 / 39
4.2.10 18 / 39
4.2.9 18 / 39
4.2.8 18 / 39
4.2.7 18 / 39
4.2.6 18 / 39
4.2.5 18 / 39
4.2.4 18 / 39
4.2.3 18 / 39
4.2.2 18 / 39
4.2.1 18 / 39
4.2.0 18 / 39
4.1.1 18 / 39
4.1.0 18 / 39
4.0.37 18 / 39
4.0.36 18 / 39
4.0.35 18 / 39

v4.11.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.11.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.11.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.11.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.11.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.10.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.10.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.10.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.10.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.10.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.10.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.8.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.8.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.8.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.8.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.8.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.7.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.6.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.5.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.4.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.3.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.10

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.9

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.8

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.7

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.6

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.5

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.2.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.37

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.36

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v4.0.35

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.