macOS
Homebrewverifiziert · 100%
brew install phylum-clilocal Homebrew formula metadata
brew / Rang 12091
phylum-cli mit Homebrew installieren
Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für phylum-cli in AI-Agent-Workflows.
Installation
Weitere Installationsbefehle
Überblick
Paketzusammenfassung
Command-line interface for the Phylum API
Projektlinks
Befehle und Aliase
- phylum
Verlauf
Projektgeschichte und Nutzung
Phylum CLI is an open-source client for submitting dependency manifests and lockfiles to the Phylum software-supply-chain analysis service and enforcing package risk checks in developer workflows.
Projektgeschichte
Phylum, Inc. developed the open-source Rust CLI as the command-line interface to its software-supply-chain analysis API. The tool grew beyond submitting dependency files to include authentication, policy exceptions, package-firewall commands, extensions, and protected package-manager workflows. The product later became part of Veracode.
Adoptionsgeschichte
The CLI was distributed as prebuilt Linux and macOS binaries, with Homebrew recommended on macOS, and supported dependency files from numerous language ecosystems. Phylum was subsequently acquired by Veracode; the official documentation now labels the platform legacy and records that the free Community service ended in 2025.
Wie es verwendet wird
Users authenticate with `phylum auth login`, initialize a project with `phylum init`, and submit dependency files using `phylum analyze`. An API key is stored in `settings.yaml` or supplied through `PHYLUM_API_KEY`; ecosystem extensions can wrap package-manager installations with pre-install analysis and sandboxing.
Warum Paket-Nerds sich dafür interessieren
Phylum combined dependency-file analysis with package-manager interception: users could submit lockfiles for remote risk analysis and prefix supported installation commands with `phylum` for pre-install checks. Its sandboxed lockfile generation addressed the unusual supply-chain risk that dependency resolution itself can execute untrusted code.
Zeitleiste
- 2022: The open-source CLI repository identifies Phylum, Inc. as its copyright holder.
- 2023: Official changelogs documented broader manifest handling, SBOM support, and package-analysis workflows.
- 2025: Phylum ended its free Community service after becoming part of Veracode.
Related projects
- The Phylum API performs the remote analysis requested by the CLI.
- Birdcage provides the sandbox used by Phylum's protected installation and lockfile-generation workflows.
- Supported ecosystem package managers can be wrapped by Phylum extensions for pre-install checks.
Quellen
Sicherheitslage
Risikostufe: grün
narrow executable package without higher-risk signals.
Risikoklassifikator
grün Risiko · niedrig Konfidenz · appliance
Warum
- narrow executable package without higher-risk signals
Signale
- metadata:no-higher-risk-signals
Installationsverhalten
- In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
- Homebrew-Bottle-Metadaten sind für 7 Plattformziele verfügbar.
- Build-Metadaten listen 2 Build-Abhängigkeiten.
Empfohlene Prüfung
Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
~/.config/phylum/settings.yaml
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.config/phylum/settings.yaml
Executables
Installierte Executables
| Befehl | Art | Sichtbarkeit | Hinweis |
|---|---|---|---|
phylum | cli | globales Executable |
Aktualität
Version und Aktualität
Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.
Seite generiert2026-11-04
Manager-Version7.5.0
Manager aktualisiert2026-10-04
lokale DatenOK
Upstreamaktuell
neueste erkannte Versionv7.5.0
https://github.com/phylum-dev/cli
- OKEs wurden keine Aktualitätswarnungen generiert.
Installationsmetadaten
Paketmetadaten
| Paketschlüssel | brew:phylum-cli |
|---|---|
| Version | 7.5.0 |
| Paketmanager | Homebrew |
| Paketmanager-Seite | https://formulae.brew.sh/formula/phylum-cli |
| Homepage | https://www.phylum.io |
| Repository | https://github.com/phylum-dev/cli |
| Upstream-Dokumentation | https://www.phylum.io |
| Lizenz | GPL-3.0-or-later |
| Quellarchiv | https://github.com/phylum-dev/cli/archive/refs/tags/v7.5.0.tar.gz |
| Zuletzt aktualisiert | 2026-10-04T17:35:09-04:00 |
| Pulse | updated |
| Build-Abhängigkeiten | protobuf, rust |
| Bottle | verfügbar (auf arm64_golden_gate, arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | nicht definiert |
| Dienst | keiner deklariert |
| Einschränkungen | No official extensions have been preinstalled. |
Registry-Fakten
Details aus der Quelldatenbank
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | phylum-cli |
| Aliases |
|
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
Quellspur
Aus Repository-Daten generiert
Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.
Combined YAML source
View the package source record on GitHub.
Verwendete Quellen
- Geiger risk classifier
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- package relationship graph
- package version freshness
- package-page enrichment
- pkg.so package database
- pkgdb category and tag curation