inquirer
A collection of common interactive command line user interfaces.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:mute-stream | AI (phantom-deps): mute-stream is explicitly declared in package.json; phantom-dep finding is a false positive for this package. | ai | |
| dependencies | unvetted-dep:readline2 | AI (dependencies): readline2 is a well-known readline wrapper by the same author (sboudrias); its use in inquirer is expected and stable across versions. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is an intentional design pattern in Inquirer.js for loading registered prompt types; values come from an internal registry, not arbitrary user input. Stable false positive for this package. | ai | |
| dependencies | unvetted-dep:charm | AI (dependencies): charm is a legitimate terminal manipulation library; its use in inquirer (an interactive CLI prompt package) is expected and benign across all versions. | ai | |
| dependencies | unvetted-dep:@types/mute-stream | AI (dependencies): @types/mute-stream is the TypeScript type definitions for mute-stream, a direct runtime dep of inquirer. Its inclusion is intentional and benign for this package. | ai | |
| phantom-deps | phantom-dep:@types/mute-stream | AI (phantom-deps): Type definitions are framework-scoped and loaded by convention; not a phantom dependency issue. | ai | |
| provenance | missing-githead | AI (provenance): The package.json for this version actually contains a gitHead field; the finding appears to be a false positive. Stable for this well-established package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): New deps (ora, rxjs, wrap-ansi, @inquirer/external-editor) are all established packages appropriate for CLI UI library. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainer addition in active project; no evidence of compromise and publisher has strong track record. | ai | |
| dependencies | unvetted-dep:external-editor | AI (dependencies): external-editor is a legitimate utility for spawning external editors in CLI tools, a documented dependency of inquirer. | ai | |
| dependencies | unvetted-dep:figures | AI (dependencies): figures is an established package for terminal symbols; stable dependency for inquirer's CLI UI. | ai | |
| dependencies | unvetted-dep:rx | AI (dependencies): rx is a legitimate RxJS v4 library, a long-standing dependency of inquirer; no security concern. | ai | |
| dependencies | unvetted-dep:ansi-escapes | AI (dependencies): ansi-escapes is a stable, widely-used ANSI escape code utility; unvetted status is expected for utility libraries. | ai | |
| dependencies | unvetted-dep:rxjs | AI (dependencies): rxjs is a well-established reactive library with millions of weekly downloads; its use in inquirer is expected and benign. | ai | |
| dependencies | unvetted-dep:run-async | AI (dependencies): run-async is a small, well-known utility; its use in inquirer is longstanding and expected. | ai | |
| provenance | no-provenance | AI (provenance): Package predates Sigstore provenance by years; no provenance is expected and stable for this package. | ai |
Versions (showing 100 of 235)
| Version | Deps | Published |
|---|---|---|
| 14.0.2 | 6 / 4 | |
| 14.0.1 | 6 / 4 | |
| 14.0.0 | 6 / 4 | |
| 13.4.3 | 7 / 3 | |
| 13.4.2 | 7 / 3 | |
| 13.4.1 | 7 / 3 | |
| 13.4.0 | 7 / 3 | |
| 13.3.2 | 7 / 3 | |
| 13.3.1 | 7 / 3 | |
| 13.3.0 | 7 / 3 | |
| 13.2.5 | 7 / 3 | |
| 13.2.4 | 7 / 3 | |
| 13.2.3 | 7 / 3 | |
| 13.2.2 | 7 / 3 | |
| 13.2.1 | 7 / 3 | |
| 13.2.0 | 7 / 3 | |
| 13.1.0 | 7 / 3 | |
| 13.0.2 | 7 / 3 | |
| 13.0.1 | 7 / 3 | |
| 13.0.0 | 7 / 3 | |
| 12.11.1 | 7 / 4 | |
| 12.11.0 | 7 / 4 | |
| 12.10.0 | 7 / 4 | |
| 12.9.6 | 7 / 4 | |
| 12.9.5 | 7 / 4 | |
| 12.9.4 | 7 / 4 | |
| 12.9.3 | 7 / 4 | |
| 12.9.2 | 7 / 4 | |
| 12.9.1 | 7 / 4 | |
| 12.9.0 | 7 / 4 | |
| 12.8.2 | 7 / 4 | |
| 12.8.1 | 7 / 4 | |
| 12.8.0 | 7 / 4 | |
| 12.7.0 | 7 / 4 | |
| 12.6.3 | 7 / 4 | |
| 12.6.2 | 7 / 4 | |
| 12.6.1 | 7 / 4 | |
| 12.6.0 | 7 / 4 | |
| 12.5.2 | 7 / 4 | |
| 12.5.1 | 7 / 4 | |
| 12.5.0 | 7 / 4 | |
| 12.4.3 | 7 / 4 | |
| 12.4.2 | 7 / 4 | |
| 12.4.1 | 7 / 4 | |
| 12.4.0 | 7 / 4 | |
| 12.3.3 | 7 / 4 | |
| 12.3.2 | 7 / 4 | |
| 12.3.1 | 7 / 4 | |
| 12.3.0 | 7 / 4 | |
| 12.2.0 | 7 / 4 | |
| 12.1.0 | 7 / 4 | |
| 12.0.1 | 7 / 4 | |
| 12.0.0 | 7 / 4 | |
| 11.1.0 | 8 / 0 | |
| 11.0.2 | 8 / 0 | |
| 11.0.1 | 8 / 0 | |
| 11.0.0 | 8 / 0 | |
| 10.2.2 | 8 / 0 | |
| 10.2.1 | 7 / 0 | |
| 10.2.0 | 7 / 0 | |
| 10.1.8 | 7 / 0 | |
| 10.1.7 | 7 / 0 | |
| 10.1.6 | 7 / 0 | |
| 10.1.5 | 7 / 0 | |
| 10.1.4 | 7 / 0 | |
| 10.1.3 | 7 / 0 | |
| 10.1.2 | 7 / 0 | |
| 10.1.1 | 7 / 0 | |
| 10.1.0 | 7 / 0 | |
| 10.0.4 | 7 / 0 | |
| 10.0.3 | 7 / 0 | |
| 10.0.2 | 7 / 0 | |
| 10.0.1 | 7 / 0 | |
| 10.0.0 | 7 / 0 | |
| 9.3.8 | 12 / 1 | |
| 9.3.7 | 12 / 1 | |
| 9.3.6 | 12 / 1 | |
| 9.3.5 | 12 / 1 | |
| 9.3.4 | 12 / 1 | |
| 9.3.3 | 12 / 1 | |
| 9.3.2 | 12 / 1 | |
| 9.3.1 | 12 / 1 | |
| 9.2.23 | 15 / 1 | |
| 9.2.22 | 15 / 1 | |
| 9.2.21 | 15 / 1 | |
| 9.2.20 | 15 / 1 | |
| 9.2.19 | 15 / 1 | |
| 9.2.18 | 15 / 1 | |
| 9.2.17 | 15 / 1 | |
| 9.2.16 | 15 / 1 | |
| 9.2.15 | 15 / 1 | |
| 9.2.14 | 15 / 1 | |
| 9.2.13 | 15 / 1 | |
| 9.2.12 | 15 / 1 | |
| 9.2.11 | 15 / 1 | |
| 9.2.10 | 15 / 1 | |
| 9.2.9 | 15 / 1 | |
| 9.2.8 | 15 / 1 | |
| 9.2.7 | 15 / 1 | |
| 9.2.6 | 15 / 1 |
v14.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v14.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v13.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.9.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.9.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.9.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.9.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.9.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.8.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.8.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.8.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.7.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.6.3
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.6.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.6.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: sboudrias.
v12.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.5.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.5.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.4.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.4.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.4.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.4.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.3.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v12.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v11.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.2.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.2.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.2.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.1.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v10.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.3.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.23
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.22
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.21
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.20
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.19
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.18
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.17
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.11
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v9.2.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v9.2.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.