monogit — supply chain & dependency security

monogit ships with six well-known direct dependencies that expand to a standard Node CLI tree. Scanner alerts like "shell access", "environment variable access", and "filesystem access" are capabilities of that tree (execa runs git, chalk detects color, config is read locally) — not exploits, and none in monogit's own code. Real advisories (CVEs) we track with npm audit and patch; unmaintained transitive deps we trim over time. monogit itself stores no credentials and sends no telemetry.

Back to monogit · GitHub