@sentry/cli
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | uncommon-license:FSL-1.1-MIT | AI (license): FSL-1.1-MIT is Sentry's standard license; stable for this package. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env is required to pass environment config (SENTRY_* vars) to the spawned sentry-cli binary. Standard pattern for CLI wrappers. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used to invoke the sentry-cli native binary — core functionality of this CLI wrapper package, stable across versions. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): spawn() is used to execute the sentry-cli binary; expected behavior for a CLI wrapper that delegates to a platform-specific native binary. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): @sentry/cli uses postinstall to select the correct platform binary from optional dependencies — this is the documented, stable install flow for this package across all versions. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): @sentry/cli is a scoped package under the official Sentry org namespace; Levenshtein match against 'joi' is a false positive with no plausible typosquat relationship. | ai |
Versions (showing 17 of 17)
| Version | Deps | Published |
|---|---|---|
| 3.4.3 | 4 / 9 | |
| 3.4.2 | 4 / 9 | |
| 3.4.1 | 4 / 9 | |
| 3.4.0 | 4 / 9 | |
| 3.3.4 | 4 / 9 | |
| 3.3.2 | 4 / 9 | |
| 3.3.1 | 4 / 9 | |
| 3.3.0 | 4 / 9 | |
| 3.2.0 | 4 / 9 | |
| 3.0.3 | 4 / 9 | |
| 3.0.1 | 4 / 9 | |
| 2.58.5 | 5 / 8 | |
| 2.58.4 | 5 / 8 | |
| 2.58.3 | 5 / 8 | |
| 2.58.2 | 5 / 8 | |
| 2.58.1 | 5 / 8 | |
| 2.58.0 | 5 / 8 |
v3.4.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.4.0
2 findingsScript: node ./scripts/install.js
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.3.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.58.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.58.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.58.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.58.2
2 findingsSpreading entire process.env into an object — may capture all secrets 293 | */ 294 | async function execute(args, live, silent, configFile, config = {}) { > 295 | const env = { ...process.env }; 296 | if (configFile) { 297 | env.SENTRY_PROPERTIES = configFile;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.58.1
2 findingsSpreading entire process.env into an object — may capture all secrets 293 | */ 294 | async function execute(args, live, silent, configFile, config = {}) { > 295 | const env = { ...process.env }; 296 | if (configFile) { 297 | env.SENTRY_PROPERTIES = configFile;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2.58.0
2 findingsSpreading entire process.env into an object — may capture all secrets 293 | */ 294 | async function execute(args, live, silent, configFile, config = {}) { > 295 | const env = { ...process.env }; 296 | if (configFile) { 297 | env.SENTRY_PROPERTIES = configFile;
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.