@applitools/eyes-storybook
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env to pass NODE_OPTIONS to a spawned Storybook subprocess is expected behavior for this tool. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is used to spawn Storybook; core functionality of this CLI tool. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Loads user's package.json from a resolved path to read app metadata; not arbitrary code execution. | ai | |
| phantom-deps | phantom-dep:boxen | AI (phantom-deps): boxen is a declared runtime dep; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@applitools/ufg-client | AI (phantom-deps): Same-org dep; phantom-dep heuristic false positive. | ai |
Versions (showing 34 of 34)
| Version | Deps | Published |
|---|---|---|
| 3.65.8 | 20 / 21 | |
| 3.65.7 | 20 / 21 | |
| 3.65.6 | 20 / 21 | |
| 3.65.5 | 20 / 21 | |
| 3.65.4 | 20 / 21 | |
| 3.65.2 | 20 / 19 | |
| 3.65.1 | 20 / 19 | |
| 3.65.0 | 20 / 19 | |
| 3.64.13 | 20 / 19 | |
| 3.64.12 | 20 / 19 | |
| 3.64.11 | 20 / 19 | |
| 3.64.10 | 20 / 19 | |
| 3.62.0 | 20 / 20 | |
| 3.61.4 | 20 / 20 | |
| 3.61.3 | 20 / 20 | |
| 3.61.2 | 20 / 20 | |
| 3.61.1 | 20 / 20 | |
| 3.61.0 | 20 / 20 | |
| 3.60.0 | 20 / 20 | |
| 3.59.1 | 20 / 20 | |
| 3.59.0 | 20 / 20 | |
| 3.58.3 | 20 / 20 | |
| 3.58.2 | 20 / 20 | |
| 3.58.1 | 20 / 20 | |
| 3.58.0 | 20 / 20 | |
| 3.57.2 | 20 / 20 | |
| 3.57.1 | 20 / 20 | |
| 3.57.0 | 20 / 20 | |
| 3.56.0 | 20 / 19 | |
| 3.55.9 | 19 / 19 | |
| 3.55.8 | 19 / 19 | |
| 3.55.7 | 19 / 19 | |
| 3.55.6 | 19 / 19 | |
| 3.55.5 | 19 / 19 |
v3.65.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.2
2 findingsThis version was published by a different npm account than previous versions on 2026-05-05. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.1
2 findingsThis version was published by a different npm account than previous versions on 2026-05-04. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.65.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.64.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.64.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.64.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.62.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.61.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.61.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.61.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.61.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.61.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.60.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.59.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.59.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.58.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.57.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.56.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.55.9
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.55.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.55.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.55.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v3.55.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.