arg
Unopinionated, no-frills CLI argument parser
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| bogus-package | bogus-package | AI (bogus-package): Mass-production signal is from a Vercel team member; no-keywords is cosmetic. Package is the legitimate canonical arg CLI parser. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): arg is a mature, stable utility; long dormancy between patch releases is expected. Change is minimal (removed pretest script). No signs of takeover. | ai | |
| email-domain | unclaimed-email:wavetilt.com | AI (email-domain): Author email domain is stale/unclaimed but package is the canonical vercel/arg with a large verified Vercel team maintainer list. Risk of impersonation is low given ecosystem context. | ai | |
| provenance | no-provenance | AI (provenance): Pre-Sigstore-era package from established publisher; no provenance is expected for this era of publishing. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Removed maintainers (zeit-admin, zeit-bot, qix, etc.) reflect the same 2018 Zeit/Vercel organizational transition. No malicious indicators. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers added as part of the 2018 Zeit/Vercel team restructuring. Consistent with legitimate organizational change, not a takeover. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher change from qix to timneutkens reflects a legitimate 2018 Vercel/Zeit organizational transition. timneutkens is a core Vercel team member with strong track record. | ai | |
| typosquat | typosquat.levenshtein:yargs | AI (typosquat): arg is a legitimate, long-standing package (vercel/arg); not a typosquat of yargs. | ai | |
| typosquat | typosquat.levenshtein:pg | AI (typosquat): arg is a legitimate, long-standing CLI argument parser; not a typosquat of pg. | ai | |
| typosquat | typosquat.levenshtein:ajv | AI (typosquat): arg is a legitimate, long-standing CLI argument parser; not a typosquat of ajv. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 5.0.2 | 0 / 3 | |
| 5.0.1 | 0 / 3 | |
| 5.0.0 | 0 / 3 | |
| 4.1.3 | 0 / 3 | |
| 4.1.2 | 0 / 3 | |
| 4.1.1 | 0 / 3 | |
| 4.1.0 | 0 / 3 | |
| 4.0.1 | 0 / 3 | |
| 3.0.0 | 0 / 3 | |
| 2.0.1 | 0 / 3 | |
| 2.0.0 | 0 / 3 | |
| 1.0.1 | 0 / 3 | |
| 1.0.0 | 0 / 3 | |
| 0.0.1 | 0 / 0 |
v5.0.1
3 findingsThis version was published by a different npm account than previous versions on 2021-08-17. This could indicate a legitimate maintainer transition or an account compromise.
Maintainer email '[email protected]' uses domain 'wavetilt.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v5.0.0
2 findingsMaintainer email '[email protected]' uses domain 'wavetilt.com' which has no DNS records. An attacker could register this domain to hijack the maintainer identity.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v4.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.0.0
2 findingsThis version was published by a different npm account than previous versions on 2018-12-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.1
2 findingsThis version was published by a different npm account than previous versions on 2018-11-14. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.0.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.