# Supply Chain Risk Report

---

## Metadata

- **Scan Date**: 2026-04-01
- **Project**: Kastell CLI v1.17.0
- **Repositories Scanned**: 11 repositories
- **Total Dependencies**: 11 production + 16 dev = 27 total
- **npm audit**: 0 known CVEs

---

## Executive Summary

### Counts by Risk Factor

| Risk Factor | Dependencies | Total |
|-------------|--------------|-------|
| Single maintainer | @napi-rs/keyring, p-limit, ora, zod, commander | 5 |
| Low popularity | @napi-rs/keyring | 1 |
| No security contact | @napi-rs/keyring, p-limit, ora, zod, js-yaml, chalk | 6 |
| High-risk features (native) | @napi-rs/keyring | 1 |
| Past CVEs | js-yaml (all patched v4) | 1 |
| **Total unique flagged** | -- | **6** |

### High-Risk Dependencies

| Dependency Name | Risk Factors | Notes | Suggested Alternative |
|-----------------|--------------|-------|-----------------------|
| @napi-rs/keyring | Single maintainer, Low popularity (70 stars), No SECURITY.md, Native code (OS keychain) | Solo dev (Brooooooklyn), 5 contributors, Rust+NAPI bindings with OS-level keychain access | **keytar** or OS-native CLI calls. Pin exact version. |
| p-limit | Single maintainer (sindresorhus), No SECURITY.md | Historical incident vector (2022 es-module protest). sindresorhus controls npm publish alone. | No direct alternative with org backing. Pin exact version, monitor ownership. |

## Recommendations

1. **@napi-rs/keyring** -- Pin exact version, `npm ci` in CI, consider making optional/lazy-loaded
2. **p-limit, ora** -- Monitor sindresorhus ownership transfer announcements, pin versions
3. **js-yaml** -- Stay on v4.x only, flag any transitive v3 pulls
4. **zod** -- Watch v4 migration, no SECURITY.md concern given 42K stars
5. **General** -- Add `npm audit --audit-level=high` as CI step

## Report Generated By

Supply Chain Risk Auditor Skill
Generated: 2026-04-01
